]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #26628 from msizanoen1/utf8-quote-valid
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
88213476 2
349cc4a5 3#if HAVE_BLKID
8fe0087e 4#endif
88213476 5#include <errno.h>
88213476 6#include <getopt.h>
503f480f 7#include <linux/fs.h>
1b9e5b12 8#include <linux/loop.h>
349cc4a5 9#if HAVE_SELINUX
8fe0087e 10#include <selinux/selinux.h>
1b9e5b12 11#endif
8fe0087e 12#include <stdlib.h>
8fe0087e 13#include <sys/file.h>
335d2ead 14#include <sys/ioctl.h>
8fe0087e
LP		 15#include <sys/personality.h>
16#include <sys/prctl.h>
17#include <sys/types.h>
6916b164 18#include <sys/wait.h>
335d2ead 19#include <termios.h>
8fe0087e 20#include <unistd.h>
1b9e5b12 21
b053cd5f 22#include "sd-bus.h"
1f0cd86b 23#include "sd-daemon.h"
1f0cd86b 24#include "sd-id128.h"
8fe0087e 25
b5efdb8a 26#include "alloc-util.h"
8fe0087e
LP		 27#include "barrier.h"
28#include "base-filesystem.h"
29#include "blkid-util.h"
30#include "btrfs-util.h"
d6b4d1c7 31#include "build.h"
b8ea7a6e 32#include "bus-error.h"
b053cd5f 33#include "bus-util.h"
8fe0087e 34#include "cap-list.h"
430f0182 35#include "capability-util.h"
04d391da 36#include "cgroup-util.h"
f4351959 37#include "chase-symlinks.h"
988851b6 38#include "common-signal.h"
8fe0087e 39#include "copy.h"
d107bb7d 40#include "cpu-set-util.h"
786d19fd 41#include "creds-util.h"
4fc9982c 42#include "dev-setup.h"
57f1b61b 43#include "discover-image.h"
2d845785 44#include "dissect-image.h"
8fe0087e 45#include "env-util.h"
3652872a 46#include "escape.h"
3ffd4af2 47#include "fd-util.h"
842f3b0f 48#include "fdset.h"
a5c32cff 49#include "fileio.h"
f97b34a6 50#include "format-util.h"
f4f15635 51#include "fs-util.h"
1b9e5b12 52#include "gpt.h"
4623e8e6 53#include "hexdecoct.h"
e2054217 54#include "hostname-setup.h"
8fe0087e 55#include "hostname-util.h"
910fd145 56#include "id128-util.h"
3652872a 57#include "io-util.h"
8fe0087e 58#include "log.h"
2d845785 59#include "loop-util.h"
8fe0087e 60#include "loopback-setup.h"
8fe0087e 61#include "macro.h"
44dbef90 62#include "main-func.h"
f5947a5e 63#include "missing_sched.h"
8fe0087e 64#include "mkdir.h"
4349cd7c 65#include "mount-util.h"
049af8ad 66#include "mountpoint-util.h"
0cb8e3d1 67#include "namespace-util.h"
8fe0087e 68#include "netlink-util.h"
2f893044 69#include "nspawn-bind-user.h"
07630cea 70#include "nspawn-cgroup.h"
3652872a 71#include "nspawn-creds.h"
3603efde 72#include "nspawn-def.h"
07630cea
LP		 73#include "nspawn-expose-ports.h"
74#include "nspawn-mount.h"
75#include "nspawn-network.h"
de40a303 76#include "nspawn-oci.h"
7336138e 77#include "nspawn-patch-uid.h"
07630cea 78#include "nspawn-register.h"
910fd145 79#include "nspawn-seccomp.h"
07630cea
LP		 80#include "nspawn-settings.h"
81#include "nspawn-setuid.h"
7732f92b 82#include "nspawn-stub-pid1.h"
c9394f4f 83#include "nspawn-util.h"
91181e07 84#include "nspawn.h"
d8b4d14d 85#include "nulstr-util.h"
d58ad743 86#include "os-util.h"
50ebcf6c 87#include "pager.h"
614b022c 88#include "parse-argument.h"
6bedfcbb 89#include "parse-util.h"
294bf0c3 90#include "pretty-print.h"
0b452006 91#include "process-util.h"
8fe0087e
LP		 92#include "ptyfwd.h"
93#include "random-util.h"
8869a0b4 94#include "raw-clone.h"
86775e35 95#include "resolve-util.h"
bf428efb 96#include "rlimit-util.h"
8fe0087e 97#include "rm-rf.h"
de40a303
LP		 98#if HAVE_SECCOMP
99#include "seccomp-util.h"
100#endif
68b02049 101#include "selinux-util.h"
8fe0087e 102#include "signal-util.h"
2583fbea 103#include "socket-util.h"
8fcde012 104#include "stat-util.h"
15a5e950 105#include "stdio-util.h"
5c828e66 106#include "string-table.h"
07630cea 107#include "string-util.h"
8fe0087e 108#include "strv.h"
de40a303 109#include "sysctl-util.h"
8fe0087e 110#include "terminal-util.h"
e4de7287 111#include "tmpfile-util.h"
affb60b1 112#include "umask-util.h"
43c3fb46 113#include "unit-name.h"
b1d4f8e1 114#include "user-util.h"
e9642be2 115
e96ceaba
LP		 116/* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
117#define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
e79581dd 118#define NSPAWN_MOUNT_TUNNEL "/run/host/incoming"
0e7ac751 119
2a49b612
ZJS		 120#define EXIT_FORCE_RESTART 133
121
113cea80
DH		 122typedef enum ContainerStatus {
123 CONTAINER_TERMINATED,
6145bb4f 124 CONTAINER_REBOOTED,
113cea80
DH		 125} ContainerStatus;
126
88213476 127static char *arg_directory = NULL;
ec16945e 128static char *arg_template = NULL;
5f932eb9 129static char *arg_chdir = NULL;
b53ede69
PW		 130static char *arg_pivot_root_new = NULL;
131static char *arg_pivot_root_old = NULL;
687d0825 132static char *arg_user = NULL;
de40a303
LP		 133static uid_t arg_uid = UID_INVALID;
134static gid_t arg_gid = GID_INVALID;
135static gid_t* arg_supplementary_gids = NULL;
136static size_t arg_n_supplementary_gids = 0;
9444b1f2 137static sd_id128_t arg_uuid = {};
3a9530e5
LP		 138static char *arg_machine = NULL; /* The name used by the host to refer to this */
139static char *arg_hostname = NULL; /* The name the payload sees by default */
c74e630d
LP		 140static const char *arg_selinux_context = NULL;
141static const char *arg_selinux_apifs_context = NULL;
de40a303 142static char *arg_slice = NULL;
ff01d048 143static bool arg_private_network = false;
bc2f673e 144static bool arg_read_only = false;
7732f92b 145static StartMode arg_start_mode = START_PID1;
ec16945e 146static bool arg_ephemeral = false;
57fb9fb5 147static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 148static bool arg_link_journal_try = false;
520e0d54 149static uint64_t arg_caps_retain =
50b52222
LP		 150 (1ULL << CAP_AUDIT_CONTROL) |
151 (1ULL << CAP_AUDIT_WRITE) |
5076f0cc
LP		 152 (1ULL << CAP_CHOWN) |
153 (1ULL << CAP_DAC_OVERRIDE) |
154 (1ULL << CAP_DAC_READ_SEARCH) |
155 (1ULL << CAP_FOWNER) |
156 (1ULL << CAP_FSETID) |
157 (1ULL << CAP_IPC_OWNER) |
158 (1ULL << CAP_KILL) |
159 (1ULL << CAP_LEASE) |
160 (1ULL << CAP_LINUX_IMMUTABLE) |
50b52222 161 (1ULL << CAP_MKNOD) |
5076f0cc
LP		 162 (1ULL << CAP_NET_BIND_SERVICE) |
163 (1ULL << CAP_NET_BROADCAST) |
164 (1ULL << CAP_NET_RAW) |
5076f0cc 165 (1ULL << CAP_SETFCAP) |
50b52222 166 (1ULL << CAP_SETGID) |
5076f0cc
LP		 167 (1ULL << CAP_SETPCAP) |
168 (1ULL << CAP_SETUID) |
169 (1ULL << CAP_SYS_ADMIN) |
50b52222 170 (1ULL << CAP_SYS_BOOT) |
5076f0cc
LP		 171 (1ULL << CAP_SYS_CHROOT) |
172 (1ULL << CAP_SYS_NICE) |
173 (1ULL << CAP_SYS_PTRACE) |
d87be9b0 174 (1ULL << CAP_SYS_RESOURCE) |
50b52222 175 (1ULL << CAP_SYS_TTY_CONFIG);
88fc9c9b 176static uint64_t arg_caps_ambient = 0;
de40a303 177static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
5a8af538 178static CustomMount *arg_custom_mounts = NULL;
88614c8a 179static size_t arg_n_custom_mounts = 0;
f4889f65 180static char **arg_setenv = NULL;
284c0b91 181static bool arg_quiet = false;
eb91eb18 182static bool arg_register = true;
89f7c846 183static bool arg_keep_unit = false;
aa28aefe 184static char **arg_network_interfaces = NULL;
c74e630d 185static char **arg_network_macvlan = NULL;
4bbfe7ad 186static char **arg_network_ipvlan = NULL;
69c79d3c 187static bool arg_network_veth = false;
f6d6bad1 188static char **arg_network_veth_extra = NULL;
f757855e 189static char *arg_network_bridge = NULL;
22b28dfd 190static char *arg_network_zone = NULL;
d7bea6b6 191static char *arg_network_namespace_path = NULL;
bb068de0 192static PagerFlags arg_pager_flags = 0;
050f7277 193static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 194static char *arg_image = NULL;
de40a303 195static char *arg_oci_bundle = NULL;
f757855e 196static VolatileMode arg_volatile_mode = VOLATILE_NO;
6d0b55c2 197static ExposePort *arg_expose_ports = NULL;
f36933fe 198static char **arg_property = NULL;
de40a303 199static sd_bus_message *arg_property_message = NULL;
0de7acce 200static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
6dac160c 201static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
6c045a99 202static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
c6c8f6e2 203static int arg_kill_signal = 0;
5da38d07 204static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
f757855e
LP		 205static SettingsMask arg_settings_mask = 0;
206static int arg_settings_trusted = -1;
207static char **arg_parameters = NULL;
6aadfa4c 208static const char *arg_container_service_name = "systemd-nspawn";
9c1e04d0 209static bool arg_notify_ready = false;
5a8ff0e6 210static bool arg_use_cgns = true;
0c582db0 211static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
1099ceeb 212static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
aee36b4e 213static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
6b000af4
LP		 214static char **arg_syscall_allow_list = NULL;
215static char **arg_syscall_deny_list = NULL;
de40a303
LP		 216#if HAVE_SECCOMP
217static scmp_filter_ctx arg_seccomp = NULL;
218#endif
bf428efb 219static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
66edd963 220static bool arg_no_new_privileges = false;
81f345df
LP		 221static int arg_oom_score_adjust = 0;
222static bool arg_oom_score_adjust_set = false;
0985c7c4 223static CPUSet arg_cpu_set = {};
09d423e9 224static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
1688841f 225static TimezoneMode arg_timezone = TIMEZONE_AUTO;
f5fbe71d 226static unsigned arg_console_width = UINT_MAX, arg_console_height = UINT_MAX;
de40a303
LP		 227static DeviceNode* arg_extra_nodes = NULL;
228static size_t arg_n_extra_nodes = 0;
229static char **arg_sysctl = NULL;
230static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
3652872a
LP		 231static Credential *arg_credentials = NULL;
232static size_t arg_n_credentials = 0;
2f893044 233static char **arg_bind_user = NULL;
4a4654e0 234static bool arg_suppress_sync = false;
3603f151 235static char *arg_settings_filename = NULL;
4c27749b 236static Architecture arg_architecture = _ARCHITECTURE_INVALID;
88213476 237
6145bb4f
LP		 238STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
239STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
240STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
241STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
242STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
243STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
244STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
245STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
246STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
247STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
248STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
249STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
250STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
251STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
252STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
253STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
254STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
255STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
256STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
257STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
258STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
259STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
260STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
89e62e0b 261STATIC_DESTRUCTOR_REGISTER(arg_verity_settings, verity_settings_done);
6b000af4
LP		 262STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
263STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
6145bb4f
LP		 264#if HAVE_SECCOMP
265STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
266#endif
0985c7c4 267STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
6145bb4f 268STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
2f893044 269STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
3603f151 270STATIC_DESTRUCTOR_REGISTER(arg_settings_filename, freep);
6145bb4f 271
dce66ffe
ZJS		 272static int handle_arg_console(const char *arg) {
273 if (streq(arg, "help")) {
10e8a60b
LP		 274 puts("autopipe\n"
275 "interactive\n"
dce66ffe 276 "passive\n"
10e8a60b
LP		 277 "pipe\n"
278 "read-only");
dce66ffe
ZJS		 279 return 0;
280 }
281
282 if (streq(arg, "interactive"))
283 arg_console_mode = CONSOLE_INTERACTIVE;
284 else if (streq(arg, "read-only"))
285 arg_console_mode = CONSOLE_READ_ONLY;
286 else if (streq(arg, "passive"))
287 arg_console_mode = CONSOLE_PASSIVE;
554c4beb
LP		 288 else if (streq(arg, "pipe")) {
289 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
290 log_full(arg_quiet ? LOG_DEBUG : LOG_NOTICE,
291 "Console mode 'pipe' selected, but standard input/output are connected to an interactive TTY. "
292 "Most likely you want to use 'interactive' console mode for proper interactivity and shell job control. "
293 "Proceeding anyway.");
294
dce66ffe 295 arg_console_mode = CONSOLE_PIPE;
10e8a60b
LP		 296 } else if (streq(arg, "autopipe")) {
297 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
298 arg_console_mode = CONSOLE_INTERACTIVE;
299 else
300 arg_console_mode = CONSOLE_PIPE;
554c4beb 301 } else
dce66ffe
ZJS		 302 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
303
304 arg_settings_mask |= SETTING_CONSOLE_MODE;
305 return 1;
306}
307
37ec0fdd
LP		 308static int help(void) {
309 _cleanup_free_ char *link = NULL;
310 int r;
311
384c2c32 312 pager_open(arg_pager_flags);
50ebcf6c 313
37ec0fdd
LP		 314 r = terminal_urlify_man("systemd-nspawn", "1", &link);
315 if (r < 0)
316 return log_oom();
317
25148653 318 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
37a92352 319 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
a8828ed9
DW		 320 " -h --help Show this help\n"
321 " --version Print version string\n"
69c79d3c 322 " -q --quiet Do not show status information\n"
bb068de0 323 " --no-pager Do not pipe output into a pager\n"
25148653
LP		 324 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
325 "%3$sImage:%4$s\n"
1b9e5b12 326 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 327 " --template=PATH Initialize root directory from template directory,\n"
328 " if missing\n"
329 " -x --ephemeral Run container with snapshot of root directory, and\n"
330 " remove it after exit\n"
25e68fd3
LP		 331 " -i --image=PATH Root file system disk image (or device node) for\n"
332 " the container\n"
de40a303 333 " --oci-bundle=PATH OCI bundle directory\n"
25148653
LP		 334 " --read-only Mount the root directory read-only\n"
335 " --volatile[=MODE] Run the system in volatile mode\n"
25e68fd3 336 " --root-hash=HASH Specify verity root hash for root disk image\n"
c2923fdc
LB		 337 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
338 " as a DER encoded PKCS7, either as a path to a file\n"
339 " or as an ASCII base64 encoded string prefixed by\n"
340 " 'base64:'\n"
e7cbe5cb 341 " --verity-data=PATH Specify hash device for verity\n"
25148653
LP		 342 " --pivot-root=PATH[:PATH]\n"
343 " Pivot root to given directory in the container\n\n"
344 "%3$sExecution:%4$s\n"
7732f92b 345 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
a8828ed9 346 " -b --boot Boot up full system (i.e. invoke init)\n"
5f932eb9 347 " --chdir=PATH Set working directory in the container\n"
0d2a0179 348 " -E --setenv=NAME[=VALUE] Pass an environment variable to PID 1\n"
25148653
LP		 349 " -u --user=USER Run the command under specified user or UID\n"
350 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
4a4654e0
LP		 351 " --notify-ready=BOOLEAN Receive notifications from the child init process\n"
352 " --suppress-sync=BOOLEAN\n"
353 " Suppress any form of disk data synchronization\n\n"
25148653 354 "%3$sSystem Identity:%4$s\n"
a8828ed9 355 " -M --machine=NAME Set the machine name for the container\n"
3a9530e5 356 " --hostname=NAME Override the hostname for the container\n"
25148653
LP		 357 " --uuid=UUID Set a specific machine UUID for the container\n\n"
358 "%3$sProperties:%4$s\n"
a8828ed9 359 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 360 " --property=NAME=VALUE Set scope unit property\n"
25148653
LP		 361 " --register=BOOLEAN Register container as machine\n"
362 " --keep-unit Do not register a scope for the machine, reuse\n"
363 " the service unit nspawn is running in\n\n"
364 "%3$sUser Namespacing:%4$s\n"
b917743d
YW		 365 " --private-users=no Run without user namespacing\n"
366 " --private-users=yes|pick|identity\n"
367 " Run within user namespace, autoselect UID/GID range\n"
368 " --private-users=UIDBASE[:NUIDS]\n"
90b4a64d 369 " Similar, but with user configured UID/GID range\n"
6c045a99
LP		 370 " --private-users-ownership=MODE\n"
371 " Adjust ('chown') or map ('map') OS tree ownership\n"
b917743d
YW		 372 " to private UID/GID range\n"
373 " -U Equivalent to --private-users=pick and\n"
374 " --private-users-ownership=auto\n\n"
25148653 375 "%3$sNetworking:%4$s\n"
69c79d3c
LP		 376 " --private-network Disable network in container\n"
377 " --network-interface=INTERFACE\n"
378 " Assign an existing network interface to the\n"
379 " container\n"
c74e630d
LP		 380 " --network-macvlan=INTERFACE\n"
381 " Create a macvlan network interface based on an\n"
382 " existing network interface to the container\n"
4bbfe7ad 383 " --network-ipvlan=INTERFACE\n"
387f6955 384 " Create an ipvlan network interface based on an\n"
4bbfe7ad 385 " existing network interface to the container\n"
a8eaaee7 386 " -n --network-veth Add a virtual Ethernet connection between host\n"
69c79d3c 387 " and container\n"
f6d6bad1
LP		 388 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
389 " Add an additional virtual Ethernet link between\n"
390 " host and container\n"
ab046dde 391 " --network-bridge=INTERFACE\n"
90b4a64d
ZJS		 392 " Add a virtual Ethernet connection to the container\n"
393 " and attach it to an existing bridge on the host\n"
394 " --network-zone=NAME Similar, but attach the new interface to an\n"
395 " an automatically managed bridge interface\n"
d7bea6b6
DP		 396 " --network-namespace-path=PATH\n"
397 " Set network namespace to the one represented by\n"
398 " the specified kernel namespace file node\n"
6d0b55c2 399 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
25148653
LP		 400 " Expose a container IP port on the host\n\n"
401 "%3$sSecurity:%4$s\n"
a8828ed9
DW		 402 " --capability=CAP In addition to the default, retain specified\n"
403 " capability\n"
404 " --drop-capability=CAP Drop the specified capability from the default set\n"
88fc9c9b
TH		 405 " --ambient-capability=CAP\n"
406 " Sets the specified capability for the started\n"
407 " process. Not useful if booting a machine.\n"
f4e803c8 408 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
960e4569
LP		 409 " --system-call-filter=LIST|~LIST\n"
410 " Permit/prohibit specific system calls\n"
25148653
LP		 411 " -Z --selinux-context=SECLABEL\n"
412 " Set the SELinux security context to be used by\n"
413 " processes in the container\n"
414 " -L --selinux-apifs-context=SECLABEL\n"
415 " Set the SELinux security context to be used by\n"
416 " API/tmpfs file systems in the container\n\n"
417 "%3$sResources:%4$s\n"
bf428efb 418 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
81f345df
LP		 419 " --oom-score-adjust=VALUE\n"
420 " Adjust the OOM score value for the payload\n"
f4e803c8
LP		 421 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
422 " --personality=ARCH Pick personality for this container\n\n"
25148653 423 "%3$sIntegration:%4$s\n"
09d423e9 424 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
1688841f 425 " --timezone=MODE Select mode of /etc/localtime initialization\n"
25148653
LP		 426 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
427 " host, try-guest, try-host\n"
428 " -j Equivalent to --link-journal=try-guest\n\n"
429 "%3$sMounts:%4$s\n"
5e5bfa6e
EY		 430 " --bind=PATH[:PATH[:OPTIONS]]\n"
431 " Bind mount a file or directory from the host into\n"
a8828ed9 432 " the container\n"
5e5bfa6e
EY		 433 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
434 " Similar, but creates a read-only bind mount\n"
de40a303
LP		 435 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
436 " it\n"
06c17c39 437 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 438 " --overlay=PATH[:PATH...]:PATH\n"
439 " Create an overlay mount from the host to \n"
440 " the container\n"
441 " --overlay-ro=PATH[:PATH...]:PATH\n"
2f893044
LP		 442 " Similar, but creates a read-only overlay mount\n"
443 " --bind-user=NAME Bind user from host to container\n\n"
25148653 444 "%3$sInput/Output:%4$s\n"
de40a303
LP		 445 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
446 " set up for the container.\n"
3652872a
LP		 447 " -P --pipe Equivalent to --console=pipe\n\n"
448 "%3$sCredentials:%4$s\n"
449 " --set-credential=ID:VALUE\n"
450 " Pass a credential with literal value to container.\n"
451 " --load-credential=ID:PATH\n"
452 " Load credential to pass to container from file or\n"
453 " AF_UNIX stream socket.\n"
bc556335
DDM		 454 "\nSee the %2$s for details.\n",
455 program_invocation_short_name,
456 link,
457 ansi_underline(),
458 ansi_normal(),
459 ansi_highlight(),
460 ansi_normal());
37ec0fdd
LP		 461
462 return 0;
88213476
LP		 463}
464
86c0dd4a 465static int custom_mount_check_all(void) {
88614c8a 466 size_t i;
5a8af538 467
5a8af538
LP		 468 for (i = 0; i < arg_n_custom_mounts; i++) {
469 CustomMount *m = &arg_custom_mounts[i];
470
0de7acce 471 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
6c045a99 472 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_OFF)
baaa35ad 473 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
c920b863 474 "--private-users-ownership=own may not be combined with custom root mounts.");
6c045a99 475 if (arg_uid_shift == UID_INVALID)
baaa35ad
ZJS		 476 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
477 "--private-users with automatic UID shift may not be combined with custom root mounts.");
825d5287 478 }
5a8af538
LP		 479 }
480
481 return 0;
482}
483
8199d554 484static int detect_unified_cgroup_hierarchy_from_environment(void) {
c78c095b 485 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
415fc41c 486 int r;
5da38d07 487
efdb0237 488 /* Allow the user to control whether the unified hierarchy is used */
c78c095b
ZJS		 489
490 e = getenv(var);
491 if (!e) {
d5fc5b2f 492 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
c78c095b
ZJS		 493 var = "UNIFIED_CGROUP_HIERARCHY";
494 e = getenv(var);
c78c095b
ZJS		 495 }
496
497 if (!isempty(e)) {
efdb0237
LP		 498 r = parse_boolean(e);
499 if (r < 0)
c78c095b 500 return log_error_errno(r, "Failed to parse $%s: %m", var);
5da38d07
TH		 501 if (r > 0)
502 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
503 else
504 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237
LP		 505 }
506
8199d554
LP		 507 return 0;
508}
509
510static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
511 int r;
512
75b0d8b8
ZJS		 513 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
514 * in the image actually supports. */
b4cccbc1
LP		 515 r = cg_all_unified();
516 if (r < 0)
517 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
518 if (r > 0) {
a8725a06
ZJS		 519 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
520 * routine only detects 231, so we'll have a false negative here for 230. */
7e6821ed 521 r = systemd_installation_has_version(directory, "230");
a8725a06
ZJS		 522 if (r < 0)
523 return log_error_errno(r, "Failed to determine systemd version in container: %m");
524 if (r > 0)
525 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
526 else
527 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
c22800e4 528 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2977724b 529 /* Mixed cgroup hierarchy support was added in 233 */
7e6821ed 530 r = systemd_installation_has_version(directory, "233");
0fd9563f
ZJS		 531 if (r < 0)
532 return log_error_errno(r, "Failed to determine systemd version in container: %m");
533 if (r > 0)
534 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
535 else
536 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
537 } else
5da38d07 538 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 539
8199d554
LP		 540 log_debug("Using %s hierarchy for container.",
541 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
542 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
543
efdb0237
LP		 544 return 0;
545}
546
8a99bd0c
ZJS		 547static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
548 uint64_t mask = 0;
549 int r;
550
551 for (;;) {
552 _cleanup_free_ char *t = NULL;
553
554 r = extract_first_word(&spec, &t, ",", 0);
555 if (r < 0)
556 return log_error_errno(r, "Failed to parse capability %s.", t);
557 if (r == 0)
558 break;
559
560 if (streq(t, "help")) {
561 for (int i = 0; i < capability_list_length(); i++) {
562 const char *name;
563
564 name = capability_to_name(i);
565 if (name)
566 puts(name);
567 }
568
569 return 0; /* quit */
570 }
571
572 if (streq(t, "all"))
f5fbe71d 573 mask = UINT64_MAX;
8a99bd0c
ZJS		 574 else {
575 r = capability_from_name(t);
576 if (r < 0)
577 return log_error_errno(r, "Failed to parse capability %s.", t);
578
579 mask |= 1ULL << r;
580 }
581 }
582
583 *ret_mask = mask;
584 return 1; /* continue */
585}
586
49048684 587static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
0c582db0
LB		 588 int r;
589
590 r = getenv_bool(name);
591 if (r == -ENXIO)
49048684 592 return 0;
0c582db0 593 if (r < 0)
49048684 594 return log_error_errno(r, "Failed to parse $%s: %m", name);
de40a303 595
0c582db0 596 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
de40a303 597 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
49048684 598 return 0;
0c582db0
LB		 599}
600
49048684 601static int parse_mount_settings_env(void) {
4f086aab 602 const char *e;
1099ceeb
LP		 603 int r;
604
605 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
49048684
ZJS		 606 if (r < 0 && r != -ENXIO)
607 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
1099ceeb
LP		 608 if (r >= 0)
609 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
4f086aab
SU		 610
611 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
49048684 612 if (streq_ptr(e, "network"))
4f086aab 613 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
4f086aab 614
49048684
ZJS		 615 else if (e) {
616 r = parse_boolean(e);
617 if (r < 0)
618 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
619
620 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
621 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
ab8ee0f2 622 }
4f086aab 623
49048684 624 return 0;
4f086aab
SU		 625}
626
49048684 627static int parse_environment(void) {
d5455d2f
LP		 628 const char *e;
629 int r;
630
49048684
ZJS		 631 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
632 if (r < 0)
633 return r;
634 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
635 if (r < 0)
636 return r;
637 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
638 if (r < 0)
639 return r;
640 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
641 if (r < 0)
642 return r;
d5455d2f 643
49048684
ZJS		 644 r = parse_mount_settings_env();
645 if (r < 0)
646 return r;
d5455d2f 647
489fae52
ZJS		 648 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
649 * even if it is supported. If not supported, it has no effect. */
de40a303 650 if (!cg_ns_supported())
489fae52 651 arg_use_cgns = false;
de40a303
LP		 652 else {
653 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
654 if (r < 0) {
655 if (r != -ENXIO)
49048684 656 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
de40a303
LP		 657
658 arg_use_cgns = true;
659 } else {
660 arg_use_cgns = r > 0;
661 arg_settings_mask |= SETTING_USE_CGNS;
662 }
663 }
d5455d2f
LP		 664
665 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
666 if (e)
667 arg_container_service_name = e;
668
4a4654e0
LP		 669 r = getenv_bool("SYSTEMD_SUPPRESS_SYNC");
670 if (r >= 0)
671 arg_suppress_sync = r;
672 else if (r != -ENXIO)
673 log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
674
49048684 675 return detect_unified_cgroup_hierarchy_from_environment();
d5455d2f
LP		 676}
677
88213476 678static int parse_argv(int argc, char *argv[]) {
a41fe3a2 679 enum {
acbeb427
ZJS		 680 ARG_VERSION = 0x100,
681 ARG_PRIVATE_NETWORK,
bc2f673e 682 ARG_UUID,
5076f0cc 683 ARG_READ_ONLY,
57fb9fb5 684 ARG_CAPABILITY,
88fc9c9b 685 ARG_AMBIENT_CAPABILITY,
420c7379 686 ARG_DROP_CAPABILITY,
17fe0523
LP		 687 ARG_LINK_JOURNAL,
688 ARG_BIND,
f4889f65 689 ARG_BIND_RO,
06c17c39 690 ARG_TMPFS,
5a8af538
LP		 691 ARG_OVERLAY,
692 ARG_OVERLAY_RO,
de40a303 693 ARG_INACCESSIBLE,
eb91eb18 694 ARG_SHARE_SYSTEM,
89f7c846 695 ARG_REGISTER,
aa28aefe 696 ARG_KEEP_UNIT,
69c79d3c 697 ARG_NETWORK_INTERFACE,
c74e630d 698 ARG_NETWORK_MACVLAN,
4bbfe7ad 699 ARG_NETWORK_IPVLAN,
ab046dde 700 ARG_NETWORK_BRIDGE,
22b28dfd 701 ARG_NETWORK_ZONE,
f6d6bad1 702 ARG_NETWORK_VETH_EXTRA,
d7bea6b6 703 ARG_NETWORK_NAMESPACE_PATH,
6afc95b7 704 ARG_PERSONALITY,
4d9f07b4 705 ARG_VOLATILE,
ec16945e 706 ARG_TEMPLATE,
f36933fe 707 ARG_PROPERTY,
6dac160c 708 ARG_PRIVATE_USERS,
c6c8f6e2 709 ARG_KILL_SIGNAL,
f757855e 710 ARG_SETTINGS,
5f932eb9 711 ARG_CHDIR,
b53ede69 712 ARG_PIVOT_ROOT,
7336138e 713 ARG_PRIVATE_USERS_CHOWN,
6c045a99 714 ARG_PRIVATE_USERS_OWNERSHIP,
9c1e04d0 715 ARG_NOTIFY_READY,
4623e8e6 716 ARG_ROOT_HASH,
89e62e0b
LP		 717 ARG_ROOT_HASH_SIG,
718 ARG_VERITY_DATA,
960e4569 719 ARG_SYSTEM_CALL_FILTER,
bf428efb 720 ARG_RLIMIT,
3a9530e5 721 ARG_HOSTNAME,
66edd963 722 ARG_NO_NEW_PRIVILEGES,
81f345df 723 ARG_OOM_SCORE_ADJUST,
d107bb7d 724 ARG_CPU_AFFINITY,
09d423e9 725 ARG_RESOLV_CONF,
1688841f 726 ARG_TIMEZONE,
de40a303
LP		 727 ARG_CONSOLE,
728 ARG_PIPE,
729 ARG_OCI_BUNDLE,
bb068de0 730 ARG_NO_PAGER,
3652872a
LP		 731 ARG_SET_CREDENTIAL,
732 ARG_LOAD_CREDENTIAL,
2f893044 733 ARG_BIND_USER,
4a4654e0 734 ARG_SUPPRESS_SYNC,
a41fe3a2
LP		 735 };
736
88213476 737 static const struct option options[] = {
d7bea6b6
DP		 738 { "help", no_argument, NULL, 'h' },
739 { "version", no_argument, NULL, ARG_VERSION },
740 { "directory", required_argument, NULL, 'D' },
741 { "template", required_argument, NULL, ARG_TEMPLATE },
742 { "ephemeral", no_argument, NULL, 'x' },
743 { "user", required_argument, NULL, 'u' },
744 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
745 { "as-pid2", no_argument, NULL, 'a' },
746 { "boot", no_argument, NULL, 'b' },
747 { "uuid", required_argument, NULL, ARG_UUID },
748 { "read-only", no_argument, NULL, ARG_READ_ONLY },
749 { "capability", required_argument, NULL, ARG_CAPABILITY },
88fc9c9b 750 { "ambient-capability", required_argument, NULL, ARG_AMBIENT_CAPABILITY },
d7bea6b6 751 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
66edd963 752 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
d7bea6b6
DP		 753 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
754 { "bind", required_argument, NULL, ARG_BIND },
755 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
756 { "tmpfs", required_argument, NULL, ARG_TMPFS },
757 { "overlay", required_argument, NULL, ARG_OVERLAY },
758 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
de40a303 759 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
d7bea6b6 760 { "machine", required_argument, NULL, 'M' },
3a9530e5 761 { "hostname", required_argument, NULL, ARG_HOSTNAME },
d7bea6b6
DP		 762 { "slice", required_argument, NULL, 'S' },
763 { "setenv", required_argument, NULL, 'E' },
764 { "selinux-context", required_argument, NULL, 'Z' },
765 { "selinux-apifs-context", required_argument, NULL, 'L' },
766 { "quiet", no_argument, NULL, 'q' },
767 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
768 { "register", required_argument, NULL, ARG_REGISTER },
769 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
770 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
771 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
772 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
773 { "network-veth", no_argument, NULL, 'n' },
774 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
775 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
776 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
777 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
778 { "personality", required_argument, NULL, ARG_PERSONALITY },
779 { "image", required_argument, NULL, 'i' },
780 { "volatile", optional_argument, NULL, ARG_VOLATILE },
781 { "port", required_argument, NULL, 'p' },
782 { "property", required_argument, NULL, ARG_PROPERTY },
783 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
6c045a99
LP		 784 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN }, /* obsolete */
785 { "private-users-ownership",required_argument, NULL, ARG_PRIVATE_USERS_OWNERSHIP},
d7bea6b6
DP		 786 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
787 { "settings", required_argument, NULL, ARG_SETTINGS },
788 { "chdir", required_argument, NULL, ARG_CHDIR },
789 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
790 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
791 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
89e62e0b
LP		 792 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
793 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
d7bea6b6 794 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
bf428efb 795 { "rlimit", required_argument, NULL, ARG_RLIMIT },
81f345df 796 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
d107bb7d 797 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
09d423e9 798 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
1688841f 799 { "timezone", required_argument, NULL, ARG_TIMEZONE },
de40a303
LP		 800 { "console", required_argument, NULL, ARG_CONSOLE },
801 { "pipe", no_argument, NULL, ARG_PIPE },
802 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
bb068de0 803 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
3652872a
LP		 804 { "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
805 { "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
2f893044 806 { "bind-user", required_argument, NULL, ARG_BIND_USER },
4a4654e0 807 { "suppress-sync", required_argument, NULL, ARG_SUPPRESS_SYNC },
eb9da376 808 {}
88213476
LP		 809 };
810
9444b1f2 811 int c, r;
a42c8b54 812 uint64_t plus = 0, minus = 0;
f757855e 813 bool mask_all_settings = false, mask_no_settings = false;
88213476
LP		 814
815 assert(argc >= 0);
816 assert(argv);
817
de40a303 818 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
88213476
LP		 819 switch (c) {
820
821 case 'h':
37ec0fdd 822 return help();
88213476 823
acbeb427 824 case ARG_VERSION:
3f6fd1ba 825 return version();
acbeb427 826
88213476 827 case 'D':
614b022c 828 r = parse_path_argument(optarg, false, &arg_directory);
ec16945e 829 if (r < 0)
0f03c2a4 830 return r;
de40a303
LP		 831
832 arg_settings_mask |= SETTING_DIRECTORY;
ec16945e
LP		 833 break;
834
835 case ARG_TEMPLATE:
614b022c 836 r = parse_path_argument(optarg, false, &arg_template);
ec16945e 837 if (r < 0)
0f03c2a4 838 return r;
de40a303
LP		 839
840 arg_settings_mask |= SETTING_DIRECTORY;
88213476
LP		 841 break;
842
1b9e5b12 843 case 'i':
614b022c 844 r = parse_path_argument(optarg, false, &arg_image);
ec16945e 845 if (r < 0)
0f03c2a4 846 return r;
de40a303
LP		 847
848 arg_settings_mask |= SETTING_DIRECTORY;
849 break;
850
851 case ARG_OCI_BUNDLE:
614b022c 852 r = parse_path_argument(optarg, false, &arg_oci_bundle);
de40a303
LP		 853 if (r < 0)
854 return r;
855
ec16945e
LP		 856 break;
857
858 case 'x':
859 arg_ephemeral = true;
a2f577fc 860 arg_settings_mask |= SETTING_EPHEMERAL;
1b9e5b12
LP		 861 break;
862
687d0825 863 case 'u':
2fc09a9c
DM		 864 r = free_and_strdup(&arg_user, optarg);
865 if (r < 0)
7027ff61 866 return log_oom();
687d0825 867
f757855e 868 arg_settings_mask |= SETTING_USER;
687d0825
MV		 869 break;
870
22b28dfd
LP		 871 case ARG_NETWORK_ZONE: {
872 char *j;
873
b910cc72 874 j = strjoin("vz-", optarg);
22b28dfd
LP		 875 if (!j)
876 return log_oom();
877
878 if (!ifname_valid(j)) {
879 log_error("Network zone name not valid: %s", j);
880 free(j);
881 return -EINVAL;
882 }
883
df1fac6d 884 free_and_replace(arg_network_zone, j);
22b28dfd
LP		 885
886 arg_network_veth = true;
887 arg_private_network = true;
888 arg_settings_mask |= SETTING_NETWORK;
889 break;
890 }
891
ab046dde 892 case ARG_NETWORK_BRIDGE:
ef76dff2 893
baaa35ad
ZJS		 894 if (!ifname_valid(optarg))
895 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
896 "Bridge interface name not valid: %s", optarg);
ef76dff2 897
f757855e
LP		 898 r = free_and_strdup(&arg_network_bridge, optarg);
899 if (r < 0)
900 return log_oom();
ab046dde 901
4831981d 902 _fallthrough_;
0dfaa006 903 case 'n':
69c79d3c
LP		 904 arg_network_veth = true;
905 arg_private_network = true;
f757855e 906 arg_settings_mask |= SETTING_NETWORK;
69c79d3c
LP		 907 break;
908
f6d6bad1
LP		 909 case ARG_NETWORK_VETH_EXTRA:
910 r = veth_extra_parse(&arg_network_veth_extra, optarg);
911 if (r < 0)
912 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
913
914 arg_private_network = true;
915 arg_settings_mask |= SETTING_NETWORK;
916 break;
917
aa28aefe 918 case ARG_NETWORK_INTERFACE:
baaa35ad
ZJS		 919 if (!ifname_valid(optarg))
920 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
921 "Network interface name not valid: %s", optarg);
ef76dff2 922
b390f178
DDM		 923 r = test_network_interface_initialized(optarg);
924 if (r < 0)
925 return r;
926
c74e630d
LP		 927 if (strv_extend(&arg_network_interfaces, optarg) < 0)
928 return log_oom();
929
930 arg_private_network = true;
f757855e 931 arg_settings_mask |= SETTING_NETWORK;
c74e630d
LP		 932 break;
933
934 case ARG_NETWORK_MACVLAN:
ef76dff2 935
baaa35ad
ZJS		 936 if (!ifname_valid(optarg))
937 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
938 "MACVLAN network interface name not valid: %s", optarg);
ef76dff2 939
b390f178
DDM		 940 r = test_network_interface_initialized(optarg);
941 if (r < 0)
942 return r;
943
c74e630d 944 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 945 return log_oom();
946
4bbfe7ad 947 arg_private_network = true;
f757855e 948 arg_settings_mask |= SETTING_NETWORK;
4bbfe7ad
TG		 949 break;
950
951 case ARG_NETWORK_IPVLAN:
ef76dff2 952
baaa35ad
ZJS		 953 if (!ifname_valid(optarg))
954 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
955 "IPVLAN network interface name not valid: %s", optarg);
ef76dff2 956
b390f178
DDM		 957 r = test_network_interface_initialized(optarg);
958 if (r < 0)
959 return r;
960
4bbfe7ad
TG		 961 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
962 return log_oom();
963
4831981d 964 _fallthrough_;
ff01d048
LP		 965 case ARG_PRIVATE_NETWORK:
966 arg_private_network = true;
f757855e 967 arg_settings_mask |= SETTING_NETWORK;
a41fe3a2
LP		 968 break;
969
d7bea6b6 970 case ARG_NETWORK_NAMESPACE_PATH:
614b022c 971 r = parse_path_argument(optarg, false, &arg_network_namespace_path);
d7bea6b6
DP		 972 if (r < 0)
973 return r;
974
de40a303 975 arg_settings_mask |= SETTING_NETWORK;
d7bea6b6
DP		 976 break;
977
0f0dbc46 978 case 'b':
baaa35ad
ZJS		 979 if (arg_start_mode == START_PID2)
980 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
981 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 982
983 arg_start_mode = START_BOOT;
984 arg_settings_mask |= SETTING_START_MODE;
985 break;
986
987 case 'a':
baaa35ad
ZJS		 988 if (arg_start_mode == START_BOOT)
989 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
990 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 991
992 arg_start_mode = START_PID2;
993 arg_settings_mask |= SETTING_START_MODE;
0f0dbc46
LP		 994 break;
995
144f0fc0 996 case ARG_UUID:
9444b1f2 997 r = sd_id128_from_string(optarg, &arg_uuid);
317feb4d
LP		 998 if (r < 0)
999 return log_error_errno(r, "Invalid UUID: %s", optarg);
1000
baaa35ad
ZJS		 1001 if (sd_id128_is_null(arg_uuid))
1002 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1003 "Machine UUID may not be all zeroes.");
f757855e
LP		 1004
1005 arg_settings_mask |= SETTING_MACHINE_ID;
9444b1f2 1006 break;
aa96c6cb 1007
43c3fb46
LP		 1008 case 'S': {
1009 _cleanup_free_ char *mangled = NULL;
1010
1011 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
de40a303
LP		 1012 if (r < 0)
1013 return log_oom();
1014
43c3fb46 1015 free_and_replace(arg_slice, mangled);
de40a303 1016 arg_settings_mask |= SETTING_SLICE;
144f0fc0 1017 break;
43c3fb46 1018 }
144f0fc0 1019
7027ff61 1020 case 'M':
c1521918 1021 if (isempty(optarg))
97b11eed 1022 arg_machine = mfree(arg_machine);
c1521918 1023 else {
52ef5dd7 1024 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1025 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1026 "Invalid machine name: %s", optarg);
7027ff61 1027
0c3c4284
LP		 1028 r = free_and_strdup(&arg_machine, optarg);
1029 if (r < 0)
eb91eb18 1030 return log_oom();
eb91eb18 1031 }
9ce6d1b3 1032 break;
7027ff61 1033
3a9530e5
LP		 1034 case ARG_HOSTNAME:
1035 if (isempty(optarg))
1036 arg_hostname = mfree(arg_hostname);
1037 else {
52ef5dd7 1038 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1039 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1040 "Invalid hostname: %s", optarg);
3a9530e5
LP		 1041
1042 r = free_and_strdup(&arg_hostname, optarg);
1043 if (r < 0)
1044 return log_oom();
1045 }
1046
1047 arg_settings_mask |= SETTING_HOSTNAME;
1048 break;
1049
82adf6af
LP		 1050 case 'Z':
1051 arg_selinux_context = optarg;
a8828ed9
DW		 1052 break;
1053
82adf6af
LP		 1054 case 'L':
1055 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 1056 break;
1057
bc2f673e
LP		 1058 case ARG_READ_ONLY:
1059 arg_read_only = true;
f757855e 1060 arg_settings_mask |= SETTING_READ_ONLY;
bc2f673e
LP		 1061 break;
1062
88fc9c9b
TH		 1063 case ARG_AMBIENT_CAPABILITY: {
1064 uint64_t m;
1065 r = parse_capability_spec(optarg, &m);
1066 if (r <= 0)
1067 return r;
1068 arg_caps_ambient |= m;
1069 arg_settings_mask |= SETTING_CAPABILITY;
1070 break;
1071 }
420c7379
LP		 1072 case ARG_CAPABILITY:
1073 case ARG_DROP_CAPABILITY: {
8a99bd0c
ZJS		 1074 uint64_t m;
1075 r = parse_capability_spec(optarg, &m);
1076 if (r <= 0)
1077 return r;
5076f0cc 1078
8a99bd0c
ZJS		 1079 if (c == ARG_CAPABILITY)
1080 plus |= m;
1081 else
1082 minus |= m;
f757855e 1083 arg_settings_mask |= SETTING_CAPABILITY;
5076f0cc
LP		 1084 break;
1085 }
66edd963
LP		 1086 case ARG_NO_NEW_PRIVILEGES:
1087 r = parse_boolean(optarg);
1088 if (r < 0)
1089 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1090
1091 arg_no_new_privileges = r;
1092 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1093 break;
1094
57fb9fb5
LP		 1095 case 'j':
1096 arg_link_journal = LINK_GUEST;
574edc90 1097 arg_link_journal_try = true;
4e1d6aa9 1098 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1099 break;
1100
1101 case ARG_LINK_JOURNAL:
4e1d6aa9 1102 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
c6147113
LP		 1103 if (r < 0)
1104 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
57fb9fb5 1105
4e1d6aa9 1106 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1107 break;
1108
17fe0523 1109 case ARG_BIND:
f757855e
LP		 1110 case ARG_BIND_RO:
1111 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1112 if (r < 0)
1113 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
17fe0523 1114
f757855e 1115 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
17fe0523 1116 break;
06c17c39 1117
f757855e
LP		 1118 case ARG_TMPFS:
1119 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1120 if (r < 0)
1121 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
5a8af538 1122
f757855e 1123 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
5a8af538 1124 break;
5a8af538
LP		 1125
1126 case ARG_OVERLAY:
ad85779a
LP		 1127 case ARG_OVERLAY_RO:
1128 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1129 if (r == -EADDRNOTAVAIL)
1130 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1131 if (r < 0)
1132 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
06c17c39 1133
f757855e 1134 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
06c17c39 1135 break;
06c17c39 1136
de40a303
LP		 1137 case ARG_INACCESSIBLE:
1138 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1139 if (r < 0)
1140 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1141
1142 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1143 break;
1144
0d2a0179
ZJS		 1145 case 'E':
1146 r = strv_env_replace_strdup_passthrough(&arg_setenv, optarg);
aaf057c4 1147 if (r < 0)
0d2a0179 1148 return log_error_errno(r, "Cannot assign environment variable %s: %m", optarg);
f4889f65 1149
f757855e 1150 arg_settings_mask |= SETTING_ENVIRONMENT;
f4889f65 1151 break;
f4889f65 1152
284c0b91
LP		 1153 case 'q':
1154 arg_quiet = true;
1155 break;
1156
8a96d94e 1157 case ARG_SHARE_SYSTEM:
a6b5216c 1158 /* We don't officially support this anymore, except for compat reasons. People should use the
0c582db0 1159 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
63d1c29f 1160 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
0c582db0 1161 arg_clone_ns_flags = 0;
8a96d94e
LP		 1162 break;
1163
eb91eb18
LP		 1164 case ARG_REGISTER:
1165 r = parse_boolean(optarg);
1166 if (r < 0) {
1167 log_error("Failed to parse --register= argument: %s", optarg);
1168 return r;
1169 }
1170
1171 arg_register = r;
1172 break;
1173
89f7c846
LP		 1174 case ARG_KEEP_UNIT:
1175 arg_keep_unit = true;
1176 break;
1177
6afc95b7
LP		 1178 case ARG_PERSONALITY:
1179
ac45f971 1180 arg_personality = personality_from_string(optarg);
baaa35ad
ZJS		 1181 if (arg_personality == PERSONALITY_INVALID)
1182 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1183 "Unknown or unsupported personality '%s'.", optarg);
6afc95b7 1184
f757855e 1185 arg_settings_mask |= SETTING_PERSONALITY;
6afc95b7
LP		 1186 break;
1187
4d9f07b4
LP		 1188 case ARG_VOLATILE:
1189
1190 if (!optarg)
f757855e 1191 arg_volatile_mode = VOLATILE_YES;
5c828e66
LP		 1192 else if (streq(optarg, "help")) {
1193 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1194 return 0;
1195 } else {
f757855e 1196 VolatileMode m;
4d9f07b4 1197
f757855e 1198 m = volatile_mode_from_string(optarg);
baaa35ad
ZJS		 1199 if (m < 0)
1200 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1201 "Failed to parse --volatile= argument: %s", optarg);
1202 else
f757855e 1203 arg_volatile_mode = m;
6d0b55c2
LP		 1204 }
1205
f757855e
LP		 1206 arg_settings_mask |= SETTING_VOLATILE_MODE;
1207 break;
6d0b55c2 1208
f757855e
LP		 1209 case 'p':
1210 r = expose_port_parse(&arg_expose_ports, optarg);
1211 if (r == -EEXIST)
1212 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1213 if (r < 0)
1214 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
6d0b55c2 1215
f757855e 1216 arg_settings_mask |= SETTING_EXPOSE_PORTS;
6d0b55c2 1217 break;
6d0b55c2 1218
f36933fe
LP		 1219 case ARG_PROPERTY:
1220 if (strv_extend(&arg_property, optarg) < 0)
1221 return log_oom();
1222
1223 break;
1224
ae209204 1225 case ARG_PRIVATE_USERS: {
33eac552 1226 int boolean;
0de7acce 1227
ae209204
ZJS		 1228 if (!optarg)
1229 boolean = true;
1230 else if (!in_charset(optarg, DIGITS))
1231 /* do *not* parse numbers as booleans */
1232 boolean = parse_boolean(optarg);
33eac552
LP		 1233 else
1234 boolean = -1;
ae209204 1235
33eac552 1236 if (boolean == 0) {
0de7acce
LP		 1237 /* no: User namespacing off */
1238 arg_userns_mode = USER_NAMESPACE_NO;
1239 arg_uid_shift = UID_INVALID;
1240 arg_uid_range = UINT32_C(0x10000);
33eac552 1241 } else if (boolean > 0) {
0de7acce
LP		 1242 /* yes: User namespacing on, UID range is read from root dir */
1243 arg_userns_mode = USER_NAMESPACE_FIXED;
1244 arg_uid_shift = UID_INVALID;
1245 arg_uid_range = UINT32_C(0x10000);
1246 } else if (streq(optarg, "pick")) {
1247 /* pick: User namespacing on, UID range is picked randomly */
6c045a99
LP		 1248 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1249 * implied by USER_NAMESPACE_PICK
33eac552 1250 * further down. */
0de7acce
LP		 1251 arg_uid_shift = UID_INVALID;
1252 arg_uid_range = UINT32_C(0x10000);
33eac552
LP		 1253
1254 } else if (streq(optarg, "identity")) {
6c2d70ce 1255 /* identity: User namespaces on, UID range is map the 0…0xFFFF range to
33eac552
LP		 1256 * itself, i.e. we don't actually map anything, but do take benefit of
1257 * isolation of capability sets. */
1258 arg_userns_mode = USER_NAMESPACE_FIXED;
1259 arg_uid_shift = 0;
1260 arg_uid_range = UINT32_C(0x10000);
0de7acce 1261 } else {
6c2058b3 1262 _cleanup_free_ char *buffer = NULL;
6dac160c
LP		 1263 const char *range, *shift;
1264
0de7acce
LP		 1265 /* anything else: User namespacing on, UID range is explicitly configured */
1266
6dac160c
LP		 1267 range = strchr(optarg, ':');
1268 if (range) {
6c2058b3
ZJS		 1269 buffer = strndup(optarg, range - optarg);
1270 if (!buffer)
1271 return log_oom();
1272 shift = buffer;
6dac160c
LP		 1273
1274 range++;
bfd292ec
ZJS		 1275 r = safe_atou32(range, &arg_uid_range);
1276 if (r < 0)
be715731 1277 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
6dac160c
LP		 1278 } else
1279 shift = optarg;
1280
be715731
ZJS		 1281 r = parse_uid(shift, &arg_uid_shift);
1282 if (r < 0)
1283 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
0de7acce
LP		 1284
1285 arg_userns_mode = USER_NAMESPACE_FIXED;
6dac160c 1286
58e13de5
LP		 1287 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
1288 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID range cannot be empty or go beyond " UID_FMT ".", UID_INVALID);
1289 }
be715731 1290
0de7acce 1291 arg_settings_mask |= SETTING_USERNS;
6dac160c 1292 break;
ae209204 1293 }
6dac160c 1294
0de7acce 1295 case 'U':
ccabee0d 1296 if (userns_supported()) {
6c045a99
LP		 1297 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1298 * implied by USER_NAMESPACE_PICK
33eac552 1299 * further down. */
ccabee0d
LP		 1300 arg_uid_shift = UID_INVALID;
1301 arg_uid_range = UINT32_C(0x10000);
1302
1303 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1304 }
1305
7336138e
LP		 1306 break;
1307
0de7acce 1308 case ARG_PRIVATE_USERS_CHOWN:
6c045a99
LP		 1309 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
1310
1311 arg_settings_mask |= SETTING_USERNS;
1312 break;
1313
1314 case ARG_PRIVATE_USERS_OWNERSHIP:
1315 if (streq(optarg, "help")) {
1316 DUMP_STRING_TABLE(user_namespace_ownership, UserNamespaceOwnership, _USER_NAMESPACE_OWNERSHIP_MAX);
1317 return 0;
1318 }
1319
1320 arg_userns_ownership = user_namespace_ownership_from_string(optarg);
1321 if (arg_userns_ownership < 0)
1322 return log_error_errno(arg_userns_ownership, "Cannot parse --user-namespace-ownership= value: %s", optarg);
0de7acce
LP		 1323
1324 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1325 break;
1326
c6c8f6e2 1327 case ARG_KILL_SIGNAL:
5c828e66
LP		 1328 if (streq(optarg, "help")) {
1329 DUMP_STRING_TABLE(signal, int, _NSIG);
1330 return 0;
1331 }
1332
29a3db75 1333 arg_kill_signal = signal_from_string(optarg);
baaa35ad 1334 if (arg_kill_signal < 0)
7211c853 1335 return log_error_errno(arg_kill_signal, "Cannot parse signal: %s", optarg);
c6c8f6e2 1336
f757855e
LP		 1337 arg_settings_mask |= SETTING_KILL_SIGNAL;
1338 break;
1339
1340 case ARG_SETTINGS:
1341
1342 /* no → do not read files
1343 * yes → read files, do not override cmdline, trust only subset
1344 * override → read files, override cmdline, trust only subset
1345 * trusted → read files, do not override cmdline, trust all
1346 */
1347
1348 r = parse_boolean(optarg);
1349 if (r < 0) {
1350 if (streq(optarg, "trusted")) {
1351 mask_all_settings = false;
1352 mask_no_settings = false;
1353 arg_settings_trusted = true;
1354
1355 } else if (streq(optarg, "override")) {
1356 mask_all_settings = false;
1357 mask_no_settings = true;
1358 arg_settings_trusted = -1;
1359 } else
1360 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1361 } else if (r > 0) {
1362 /* yes */
1363 mask_all_settings = false;
1364 mask_no_settings = false;
1365 arg_settings_trusted = -1;
1366 } else {
1367 /* no */
1368 mask_all_settings = true;
1369 mask_no_settings = false;
1370 arg_settings_trusted = false;
1371 }
1372
c6c8f6e2
LP		 1373 break;
1374
5f932eb9 1375 case ARG_CHDIR:
baaa35ad
ZJS		 1376 if (!path_is_absolute(optarg))
1377 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1378 "Working directory %s is not an absolute path.", optarg);
5f932eb9
LP		 1379
1380 r = free_and_strdup(&arg_chdir, optarg);
1381 if (r < 0)
1382 return log_oom();
1383
1384 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1385 break;
1386
b53ede69
PW		 1387 case ARG_PIVOT_ROOT:
1388 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1389 if (r < 0)
1390 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1391
1392 arg_settings_mask |= SETTING_PIVOT_ROOT;
1393 break;
1394
9c1e04d0
AP		 1395 case ARG_NOTIFY_READY:
1396 r = parse_boolean(optarg);
baaa35ad
ZJS		 1397 if (r < 0)
1398 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1399 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
9c1e04d0
AP		 1400 arg_notify_ready = r;
1401 arg_settings_mask |= SETTING_NOTIFY_READY;
1402 break;
1403
4623e8e6 1404 case ARG_ROOT_HASH: {
89e62e0b 1405 _cleanup_free_ void *k = NULL;
4623e8e6
LP		 1406 size_t l;
1407
1408 r = unhexmem(optarg, strlen(optarg), &k, &l);
1409 if (r < 0)
1410 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
89e62e0b 1411 if (l < sizeof(sd_id128_t))
c6147113 1412 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
4623e8e6 1413
89e62e0b
LP		 1414 free_and_replace(arg_verity_settings.root_hash, k);
1415 arg_verity_settings.root_hash_size = l;
4623e8e6
LP		 1416 break;
1417 }
1418
c2923fdc
LB		 1419 case ARG_ROOT_HASH_SIG: {
1420 char *value;
89e62e0b
LP		 1421 size_t l;
1422 void *p;
c2923fdc
LB		 1423
1424 if ((value = startswith(optarg, "base64:"))) {
c2923fdc
LB		 1425 r = unbase64mem(value, strlen(value), &p, &l);
1426 if (r < 0)
1427 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1428
c2923fdc 1429 } else {
89e62e0b 1430 r = read_full_file(optarg, (char**) &p, &l);
c2923fdc 1431 if (r < 0)
89e62e0b 1432 return log_error_errno(r, "Failed parse root hash signature file '%s': %m", optarg);
c2923fdc
LB		 1433 }
1434
89e62e0b
LP		 1435 free_and_replace(arg_verity_settings.root_hash_sig, p);
1436 arg_verity_settings.root_hash_sig_size = l;
c2923fdc
LB		 1437 break;
1438 }
1439
89e62e0b 1440 case ARG_VERITY_DATA:
614b022c 1441 r = parse_path_argument(optarg, false, &arg_verity_settings.data_path);
89e62e0b
LP		 1442 if (r < 0)
1443 return r;
1444 break;
1445
960e4569
LP		 1446 case ARG_SYSTEM_CALL_FILTER: {
1447 bool negative;
1448 const char *items;
1449
1450 negative = optarg[0] == '~';
1451 items = negative ? optarg + 1 : optarg;
1452
1453 for (;;) {
1454 _cleanup_free_ char *word = NULL;
1455
1456 r = extract_first_word(&items, &word, NULL, 0);
1457 if (r == 0)
1458 break;
1459 if (r == -ENOMEM)
1460 return log_oom();
1461 if (r < 0)
1462 return log_error_errno(r, "Failed to parse system call filter: %m");
1463
1464 if (negative)
6b000af4 1465 r = strv_extend(&arg_syscall_deny_list, word);
960e4569 1466 else
6b000af4 1467 r = strv_extend(&arg_syscall_allow_list, word);
960e4569
LP		 1468 if (r < 0)
1469 return log_oom();
1470 }
1471
1472 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1473 break;
1474 }
1475
bf428efb
LP		 1476 case ARG_RLIMIT: {
1477 const char *eq;
622ecfa8 1478 _cleanup_free_ char *name = NULL;
bf428efb
LP		 1479 int rl;
1480
5c828e66
LP		 1481 if (streq(optarg, "help")) {
1482 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1483 return 0;
1484 }
1485
bf428efb 1486 eq = strchr(optarg, '=');
baaa35ad
ZJS		 1487 if (!eq)
1488 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1489 "--rlimit= expects an '=' assignment.");
bf428efb
LP		 1490
1491 name = strndup(optarg, eq - optarg);
1492 if (!name)
1493 return log_oom();
1494
1495 rl = rlimit_from_string_harder(name);
baaa35ad 1496 if (rl < 0)
7211c853 1497 return log_error_errno(rl, "Unknown resource limit: %s", name);
bf428efb
LP		 1498
1499 if (!arg_rlimit[rl]) {
1500 arg_rlimit[rl] = new0(struct rlimit, 1);
1501 if (!arg_rlimit[rl])
1502 return log_oom();
1503 }
1504
1505 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1506 if (r < 0)
1507 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1508
1509 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1510 break;
1511 }
1512
81f345df
LP		 1513 case ARG_OOM_SCORE_ADJUST:
1514 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1515 if (r < 0)
1516 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1517
1518 arg_oom_score_adjust_set = true;
1519 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1520 break;
1521
d107bb7d 1522 case ARG_CPU_AFFINITY: {
0985c7c4 1523 CPUSet cpuset;
d107bb7d
LP		 1524
1525 r = parse_cpu_set(optarg, &cpuset);
1526 if (r < 0)
0985c7c4 1527 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
d107bb7d 1528
0985c7c4
ZJS		 1529 cpu_set_reset(&arg_cpu_set);
1530 arg_cpu_set = cpuset;
d107bb7d
LP		 1531 arg_settings_mask |= SETTING_CPU_AFFINITY;
1532 break;
1533 }
1534
09d423e9
LP		 1535 case ARG_RESOLV_CONF:
1536 if (streq(optarg, "help")) {
1537 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1538 return 0;
1539 }
1540
1541 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
baaa35ad 1542 if (arg_resolv_conf < 0)
7211c853 1543 return log_error_errno(arg_resolv_conf,
baaa35ad 1544 "Failed to parse /etc/resolv.conf mode: %s", optarg);
09d423e9
LP		 1545
1546 arg_settings_mask |= SETTING_RESOLV_CONF;
1547 break;
1548
1688841f
LP		 1549 case ARG_TIMEZONE:
1550 if (streq(optarg, "help")) {
1551 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1552 return 0;
1553 }
1554
1555 arg_timezone = timezone_mode_from_string(optarg);
baaa35ad 1556 if (arg_timezone < 0)
7211c853 1557 return log_error_errno(arg_timezone,
baaa35ad 1558 "Failed to parse /etc/localtime mode: %s", optarg);
1688841f
LP		 1559
1560 arg_settings_mask |= SETTING_TIMEZONE;
1561 break;
1562
de40a303 1563 case ARG_CONSOLE:
dce66ffe
ZJS		 1564 r = handle_arg_console(optarg);
1565 if (r <= 0)
1566 return r;
de40a303
LP		 1567 break;
1568
1569 case 'P':
1570 case ARG_PIPE:
dce66ffe
ZJS		 1571 r = handle_arg_console("pipe");
1572 if (r <= 0)
1573 return r;
de40a303
LP		 1574 break;
1575
bb068de0
ZJS		 1576 case ARG_NO_PAGER:
1577 arg_pager_flags |= PAGER_DISABLE;
1578 break;
1579
3652872a
LP		 1580 case ARG_SET_CREDENTIAL: {
1581 _cleanup_free_ char *word = NULL, *data = NULL;
1582 const char *p = optarg;
1583 Credential *a;
e437538f 1584 ssize_t l;
3652872a
LP		 1585
1586 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1587 if (r == -ENOMEM)
1588 return log_oom();
1589 if (r < 0)
1590 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1591 if (r == 0 || !p)
1592 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1593
1594 if (!credential_name_valid(word))
1595 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1596
12d729b2 1597 for (size_t i = 0; i < arg_n_credentials; i++)
3652872a
LP		 1598 if (streq(arg_credentials[i].id, word))
1599 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1600
1601 l = cunescape(p, UNESCAPE_ACCEPT_NUL, &data);
1602 if (l < 0)
1603 return log_error_errno(l, "Failed to unescape credential data: %s", p);
1604
1605 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1606 if (!a)
1607 return log_oom();
1608
1609 a[arg_n_credentials++] = (Credential) {
1610 .id = TAKE_PTR(word),
1611 .data = TAKE_PTR(data),
1612 .size = l,
1613 };
1614
1615 arg_credentials = a;
1616
1617 arg_settings_mask |= SETTING_CREDENTIALS;
1618 break;
1619 }
1620
1621 case ARG_LOAD_CREDENTIAL: {
1622 ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
1623 _cleanup_(erase_and_freep) char *data = NULL;
1624 _cleanup_free_ char *word = NULL, *j = NULL;
1625 const char *p = optarg;
1626 Credential *a;
1627 size_t size, i;
1628
1629 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1630 if (r == -ENOMEM)
1631 return log_oom();
1632 if (r < 0)
c941b650 1633 return log_error_errno(r, "Failed to parse --load-credential= parameter: %m");
3652872a 1634 if (r == 0 || !p)
c941b650 1635 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --load-credential=: %s", optarg);
3652872a
LP		 1636
1637 if (!credential_name_valid(word))
1638 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1639
1640 for (i = 0; i < arg_n_credentials; i++)
1641 if (streq(arg_credentials[i].id, word))
1642 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1643
1644 if (path_is_absolute(p))
1645 flags |= READ_FULL_FILE_CONNECT_SOCKET;
1646 else {
1647 const char *e;
1648
786d19fd
LP		 1649 r = get_credentials_dir(&e);
1650 if (r < 0)
1651 return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
3652872a
LP		 1652
1653 j = path_join(e, p);
1654 if (!j)
1655 return log_oom();
1656 }
1657
986311c2
LP		 1658 r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
1659 flags,
1660 NULL,
1661 &data, &size);
3652872a
LP		 1662 if (r < 0)
1663 return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
1664
1665 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1666 if (!a)
1667 return log_oom();
1668
1669 a[arg_n_credentials++] = (Credential) {
1670 .id = TAKE_PTR(word),
1671 .data = TAKE_PTR(data),
1672 .size = size,
1673 };
1674
1675 arg_credentials = a;
1676
1677 arg_settings_mask |= SETTING_CREDENTIALS;
1678 break;
1679 }
1680
2f893044
LP		 1681 case ARG_BIND_USER:
1682 if (!valid_user_group_name(optarg, 0))
1683 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid user name to bind: %s", optarg);
1684
1685 if (strv_extend(&arg_bind_user, optarg) < 0)
1686 return log_oom();
1687
1688 arg_settings_mask |= SETTING_BIND_USER;
1689 break;
1690
4a4654e0
LP		 1691 case ARG_SUPPRESS_SYNC:
1692 r = parse_boolean_argument("--suppress-sync=", optarg, &arg_suppress_sync);
1693 if (r < 0)
1694 return r;
1695
1696 arg_settings_mask |= SETTING_SUPPRESS_SYNC;
1697 break;
1698
88213476
LP		 1699 case '?':
1700 return -EINVAL;
1701
1702 default:
04499a70 1703 assert_not_reached();
88213476 1704 }
88213476 1705
60f1ec13
LP		 1706 if (argc > optind) {
1707 strv_free(arg_parameters);
1708 arg_parameters = strv_copy(argv + optind);
1709 if (!arg_parameters)
1710 return log_oom();
d7bea6b6 1711
60f1ec13
LP		 1712 arg_settings_mask |= SETTING_START_MODE;
1713 }
1714
1715 if (arg_ephemeral && arg_template && !arg_directory)
1716 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1717 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1718 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1719 * --directory=". */
1720 arg_directory = TAKE_PTR(arg_template);
1721
2642d22a
DDM		 1722 arg_caps_retain |= plus;
1723 arg_caps_retain |= arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0;
1724
1725 /* If we're not unsharing the network namespace and are unsharing the user namespace, we won't have
1726 * permissions to bind ports in the container, so let's drop the CAP_NET_BIND_SERVICE capability to
1727 * indicate that. */
1728 if (!arg_private_network && arg_userns_mode != USER_NAMESPACE_NO && arg_uid_shift > 0)
1729 arg_caps_retain &= ~(UINT64_C(1) << CAP_NET_BIND_SERVICE);
1730
1731 arg_caps_retain &= ~minus;
60f1ec13 1732
de40a303 1733 /* Make sure to parse environment before we reset the settings mask below */
49048684
ZJS		 1734 r = parse_environment();
1735 if (r < 0)
1736 return r;
de40a303 1737
60f1ec13
LP		 1738 /* Load all settings from .nspawn files */
1739 if (mask_no_settings)
1740 arg_settings_mask = 0;
1741
1742 /* Don't load any settings from .nspawn files */
1743 if (mask_all_settings)
1744 arg_settings_mask = _SETTINGS_MASK_ALL;
1745
1746 return 1;
1747}
1748
1749static int verify_arguments(void) {
1750 int r;
a6b5216c 1751
75b0d8b8
ZJS		 1752 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1753 /* If we are running the stub init in the container, we don't need to look at what the init
1754 * in the container supports, because we are not using it. Let's immediately pick the right
1755 * setting based on the host system configuration.
1756 *
1757 * We only do this, if the user didn't use an environment variable to override the detection.
1758 */
1759
1760 r = cg_all_unified();
1761 if (r < 0)
1762 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1763 if (r > 0)
1764 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1765 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1766 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1767 else
1768 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1769 }
1770
4f086aab
SU		 1771 if (arg_userns_mode != USER_NAMESPACE_NO)
1772 arg_mount_settings |= MOUNT_USE_USERNS;
1773
1774 if (arg_private_network)
1775 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1776
48a8d337
LB		 1777 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1778 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
eb91eb18 1779 arg_register = false;
baaa35ad 1780 if (arg_start_mode != START_PID1)
60f1ec13 1781 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
0c582db0 1782 }
eb91eb18 1783
6c045a99
LP		 1784 if (arg_userns_ownership < 0)
1785 arg_userns_ownership =
f61c7f88 1786 arg_userns_mode == USER_NAMESPACE_PICK ? USER_NAMESPACE_OWNERSHIP_AUTO :
6c045a99 1787 USER_NAMESPACE_OWNERSHIP_OFF;
0e7ac751 1788
60f1ec13
LP		 1789 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1790 arg_kill_signal = SIGRTMIN+3;
1791
e5a4bb0d
LP		 1792 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1793 arg_read_only = true;
1794
2436ea76
DDM		 1795 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1796 arg_read_only = true;
1797
baaa35ad 1798 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
8d9c2bca
AJ		 1799 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1800 * The latter is not technically a user session, but we don't need to labour the point. */
60f1ec13 1801 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
89f7c846 1802
baaa35ad 1803 if (arg_directory && arg_image)
60f1ec13 1804 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1b9e5b12 1805
baaa35ad 1806 if (arg_template && arg_image)
60f1ec13 1807 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
8cd328d8 1808
baaa35ad 1809 if (arg_template && !(arg_directory || arg_machine))
60f1ec13 1810 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
ec16945e 1811
baaa35ad 1812 if (arg_ephemeral && arg_template)
60f1ec13 1813 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
ec16945e 1814
baaa35ad 1815 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
60f1ec13 1816 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
df9a75e4 1817
baaa35ad 1818 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
60f1ec13 1819 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
7336138e 1820
6c045a99 1821 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_read_only)
de40a303 1822 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
6c045a99 1823 "--read-only and --private-users-ownership=chown may not be combined.");
f757855e 1824
6c045a99
LP		 1825 /* We don't support --private-users-ownership=chown together with any of the volatile modes since we
1826 * couldn't change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a
1827 * massive copy-up (in case of overlay) making the entire exercise pointless. */
1828 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_volatile_mode != VOLATILE_NO)
1829 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-ownership=chown may not be combined.");
e5a4bb0d 1830
679ecd36
SZ		 1831 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1832 * we need to error out, to avoid conflicts between different network options. */
60f1ec13
LP		 1833 if (arg_network_namespace_path &&
1834 (arg_network_interfaces || arg_network_macvlan ||
1835 arg_network_ipvlan || arg_network_veth_extra ||
1836 arg_network_bridge || arg_network_zone ||
679ecd36 1837 arg_network_veth))
de40a303 1838 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
86c0dd4a 1839
60f1ec13 1840 if (arg_network_bridge && arg_network_zone)
de40a303
LP		 1841 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1842 "--network-bridge= and --network-zone= may not be combined.");
f757855e 1843
baaa35ad 1844 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
60f1ec13 1845 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
4f086aab 1846
baaa35ad 1847 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
60f1ec13 1848 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
f757855e 1849
baaa35ad 1850 if (arg_expose_ports && !arg_private_network)
60f1ec13 1851 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
6d0b55c2 1852
88fc9c9b 1853 if (arg_caps_ambient) {
f5fbe71d 1854 if (arg_caps_ambient == UINT64_MAX)
88fc9c9b
TH		 1855 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= does not support the value all.");
1856
1857 if ((arg_caps_ambient & arg_caps_retain) != arg_caps_ambient)
1858 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not fully covered by Capability= setting.");
1859
1860 if (arg_start_mode == START_BOOT)
1861 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not useful for boot mode.");
1862 }
1863
2f893044
LP		 1864 if (arg_userns_mode == USER_NAMESPACE_NO && !strv_isempty(arg_bind_user))
1865 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--bind-user= requires --private-users");
1866
1867 /* Drop duplicate --bind-user= entries */
1868 strv_uniq(arg_bind_user);
1869
60f1ec13
LP		 1870 r = custom_mount_check_all();
1871 if (r < 0)
1872 return r;
c6c8f6e2 1873
f757855e 1874 return 0;
88213476
LP		 1875}
1876
91181e07 1877int userns_lchown(const char *p, uid_t uid, gid_t gid) {
03cfe0d5
LP		 1878 assert(p);
1879
0de7acce 1880 if (arg_userns_mode == USER_NAMESPACE_NO)
03cfe0d5
LP		 1881 return 0;
1882
1883 if (uid == UID_INVALID && gid == GID_INVALID)
1884 return 0;
1885
1886 if (uid != UID_INVALID) {
1887 uid += arg_uid_shift;
1888
1889 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1890 return -EOVERFLOW;
1891 }
1892
1893 if (gid != GID_INVALID) {
1894 gid += (gid_t) arg_uid_shift;
1895
1896 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1897 return -EOVERFLOW;
1898 }
1899
7c248223 1900 return RET_NERRNO(lchown(p, uid, gid));
b12afc8c
LP		 1901}
1902
91181e07 1903int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
03cfe0d5 1904 const char *q;
dae8b82e 1905 int r;
03cfe0d5
LP		 1906
1907 q = prefix_roota(root, path);
3f692e2e 1908 r = RET_NERRNO(mkdir(q, mode));
dae8b82e
ZJS		 1909 if (r == -EEXIST)
1910 return 0;
1911 if (r < 0)
1912 return r;
03cfe0d5
LP		 1913
1914 return userns_lchown(q, uid, gid);
1915}
1916
1688841f 1917static const char *timezone_from_path(const char *path) {
da9fc98d
LP		 1918 return PATH_STARTSWITH_SET(
1919 path,
1920 "../usr/share/zoneinfo/",
1921 "/usr/share/zoneinfo/");
1688841f
LP		 1922}
1923
83205269
LP		 1924static bool etc_writable(void) {
1925 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1926}
1927
e58a1277 1928static int setup_timezone(const char *dest) {
1688841f
LP		 1929 _cleanup_free_ char *p = NULL, *etc = NULL;
1930 const char *where, *check;
1931 TimezoneMode m;
d4036145 1932 int r;
f8440af5 1933
e58a1277
LP		 1934 assert(dest);
1935
1688841f 1936 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1688841f
LP		 1937 r = readlink_malloc("/etc/localtime", &p);
1938 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
83205269 1939 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1688841f 1940 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
83205269 1941 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1688841f
LP		 1942 else if (r < 0) {
1943 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1944 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1945 * file.
1946 *
1947 * Example:
1948 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1949 */
1950 return 0;
1951 } else if (arg_timezone == TIMEZONE_AUTO)
83205269 1952 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1688841f
LP		 1953 else
1954 m = arg_timezone;
1955 } else
1956 m = arg_timezone;
1957
1958 if (m == TIMEZONE_OFF)
1959 return 0;
1960
a5648b80 1961 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
d4036145 1962 if (r < 0) {
1688841f 1963 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
d4036145
LP		 1964 return 0;
1965 }
1966
1688841f
LP		 1967 where = strjoina(etc, "/localtime");
1968
1969 switch (m) {
1970
1971 case TIMEZONE_DELETE:
1972 if (unlink(where) < 0)
1973 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1974
d4036145 1975 return 0;
d4036145 1976
1688841f
LP		 1977 case TIMEZONE_SYMLINK: {
1978 _cleanup_free_ char *q = NULL;
1979 const char *z, *what;
4d1c38b8 1980
1688841f
LP		 1981 z = timezone_from_path(p);
1982 if (!z) {
1983 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
d4036145 1984 return 0;
1688841f 1985 }
d4036145 1986
1688841f
LP		 1987 r = readlink_malloc(where, &q);
1988 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1989 return 0; /* Already pointing to the right place? Then do nothing .. */
1990
1991 check = strjoina(dest, "/usr/share/zoneinfo/", z);
a5648b80 1992 r = chase_symlinks(check, dest, 0, NULL, NULL);
1688841f
LP		 1993 if (r < 0)
1994 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1995 else {
1996 if (unlink(where) < 0 && errno != ENOENT) {
1997 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1998 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1999 return 0;
2000 }
2001
2002 what = strjoina("../usr/share/zoneinfo/", z);
2003 if (symlink(what, where) < 0) {
2004 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
2005 errno, "Failed to correct timezone of container, ignoring: %m");
2006 return 0;
2007 }
2008
2009 break;
2010 }
2011
2012 _fallthrough_;
d4036145 2013 }
68fb0892 2014
1688841f
LP		 2015 case TIMEZONE_BIND: {
2016 _cleanup_free_ char *resolved = NULL;
2017 int found;
2018
a5648b80 2019 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
1688841f
LP		 2020 if (found < 0) {
2021 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
2022 return 0;
2023 }
2024
2025 if (found == 0) /* missing? */
2026 (void) touch(resolved);
2027
511a8cfe 2028 r = mount_nofollow_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
1688841f 2029 if (r >= 0)
511a8cfe 2030 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
1688841f
LP		 2031
2032 _fallthrough_;
79d80fc1 2033 }
4d9f07b4 2034
1688841f
LP		 2035 case TIMEZONE_COPY:
2036 /* If mounting failed, try to copy */
8a016c74 2037 r = copy_file_atomic("/etc/localtime", where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
1688841f
LP		 2038 if (r < 0) {
2039 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2040 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
2041 return 0;
2042 }
2043
2044 break;
2045
2046 default:
04499a70 2047 assert_not_reached();
d4036145 2048 }
e58a1277 2049
1688841f 2050 /* Fix permissions of the symlink or file copy we just created */
03cfe0d5
LP		 2051 r = userns_lchown(where, 0, 0);
2052 if (r < 0)
1688841f 2053 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
03cfe0d5 2054
e58a1277 2055 return 0;
88213476
LP		 2056}
2057
09d423e9
LP		 2058static int have_resolv_conf(const char *path) {
2059 assert(path);
2060
2061 if (access(path, F_OK) < 0) {
2062 if (errno == ENOENT)
2063 return 0;
2064
2065 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
2066 }
2067
2068 return 1;
2069}
2070
7357272e 2071static int resolved_listening(void) {
b8ea7a6e 2072 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
b053cd5f 2073 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
7357272e 2074 _cleanup_free_ char *dns_stub_listener_mode = NULL;
b053cd5f
LP		 2075 int r;
2076
7357272e 2077 /* Check if resolved is listening */
b053cd5f
LP		 2078
2079 r = sd_bus_open_system(&bus);
2080 if (r < 0)
b8ea7a6e 2081 return log_debug_errno(r, "Failed to open system bus: %m");
b053cd5f 2082
7357272e 2083 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
b8ea7a6e
LP		 2084 if (r < 0)
2085 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
2086 if (r == 0)
2087 return 0;
7357272e
DM		 2088
2089 r = sd_bus_get_property_string(bus,
2090 "org.freedesktop.resolve1",
2091 "/org/freedesktop/resolve1",
2092 "org.freedesktop.resolve1.Manager",
2093 "DNSStubListener",
b8ea7a6e 2094 &error,
7357272e
DM		 2095 &dns_stub_listener_mode);
2096 if (r < 0)
b8ea7a6e 2097 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
7357272e
DM		 2098
2099 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
b053cd5f
LP		 2100}
2101
2547bb41 2102static int setup_resolv_conf(const char *dest) {
09d423e9
LP		 2103 _cleanup_free_ char *etc = NULL;
2104 const char *where, *what;
2105 ResolvConfMode m;
2106 int r;
2547bb41
LP		 2107
2108 assert(dest);
2109
09d423e9
LP		 2110 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
2111 if (arg_private_network)
2112 m = RESOLV_CONF_OFF;
86775e35
LP		 2113 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
2114 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
09d423e9 2115 else if (have_resolv_conf("/etc/resolv.conf") > 0)
83205269 2116 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
09d423e9 2117 else
83205269 2118 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
86775e35 2119
09d423e9
LP		 2120 } else
2121 m = arg_resolv_conf;
2122
2123 if (m == RESOLV_CONF_OFF)
2547bb41
LP		 2124 return 0;
2125
a5648b80 2126 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
87447ae4
LP		 2127 if (r < 0) {
2128 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
2129 return 0;
2130 }
2131
2132 where = strjoina(etc, "/resolv.conf");
09d423e9
LP		 2133
2134 if (m == RESOLV_CONF_DELETE) {
2135 if (unlink(where) < 0)
2136 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
2137
87447ae4
LP		 2138 return 0;
2139 }
79d80fc1 2140
86775e35
LP		 2141 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
2142 what = PRIVATE_STATIC_RESOLV_CONF;
2143 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
2144 what = PRIVATE_UPLINK_RESOLV_CONF;
2145 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
2146 what = PRIVATE_STUB_RESOLV_CONF;
09d423e9
LP		 2147 else
2148 what = "/etc/resolv.conf";
87447ae4 2149
86775e35 2150 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
09d423e9
LP		 2151 _cleanup_free_ char *resolved = NULL;
2152 int found;
2153
a5648b80 2154 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
09d423e9
LP		 2155 if (found < 0) {
2156 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
2157 return 0;
2158 }
3539724c 2159
87447ae4
LP		 2160 if (found == 0) /* missing? */
2161 (void) touch(resolved);
5367354d 2162
511a8cfe 2163 r = mount_nofollow_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
60e76d48 2164 if (r >= 0)
511a8cfe 2165 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
86775e35
LP		 2166
2167 /* If that didn't work, let's copy the file */
3539724c
LP		 2168 }
2169
86775e35
LP		 2170 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
2171 r = copy_file_atomic(what, where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
2172 else
2173 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, 0, 0, COPY_REFLINK);
79d80fc1 2174 if (r < 0) {
3539724c
LP		 2175 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
2176 * resolved or something similar runs inside and the symlink points there.
68a313c5 2177 *
3539724c 2178 * If the disk image is read-only, there's also no point in complaining.
68a313c5 2179 */
86775e35
LP		 2180 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
2181 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
3539724c 2182 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
79d80fc1
TG		 2183 return 0;
2184 }
2547bb41 2185
03cfe0d5
LP		 2186 r = userns_lchown(where, 0, 0);
2187 if (r < 0)
3539724c 2188 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
03cfe0d5 2189
2547bb41
LP		 2190 return 0;
2191}
2192
1e4f1671 2193static int setup_boot_id(void) {
cdde6ba6
LP		 2194 _cleanup_(unlink_and_freep) char *from = NULL;
2195 _cleanup_free_ char *path = NULL;
3bbaff3e 2196 sd_id128_t rnd = SD_ID128_NULL;
cdde6ba6 2197 const char *to;
04bc4a3f
LP		 2198 int r;
2199
1eacc470 2200 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
04bc4a3f 2201
1eacc470 2202 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
cdde6ba6
LP		 2203 if (r < 0)
2204 return log_error_errno(r, "Failed to generate random boot ID path: %m");
04bc4a3f
LP		 2205
2206 r = sd_id128_randomize(&rnd);
f647962d
MS		 2207 if (r < 0)
2208 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 2209
b40c8ebd 2210 r = id128_write(path, ID128_FORMAT_UUID, rnd);
f647962d
MS		 2211 if (r < 0)
2212 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 2213
cdde6ba6
LP		 2214 from = TAKE_PTR(path);
2215 to = "/proc/sys/kernel/random/boot_id";
2216
511a8cfe 2217 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
cdde6ba6
LP		 2218 if (r < 0)
2219 return r;
04bc4a3f 2220
511a8cfe 2221 return mount_nofollow_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
04bc4a3f
LP		 2222}
2223
e58a1277 2224static int copy_devnodes(const char *dest) {
88213476
LP		 2225 static const char devnodes[] =
2226 "null\0"
2227 "zero\0"
2228 "full\0"
2229 "random\0"
2230 "urandom\0"
85614d66
TG		 2231 "tty\0"
2232 "net/tun\0";
88213476 2233
e58a1277 2234 int r = 0;
a258bf26
LP		 2235
2236 assert(dest);
124640f1 2237
52f05ef2 2238 BLOCK_WITH_UMASK(0000);
88213476 2239
03cfe0d5
LP		 2240 /* Create /dev/net, so that we can create /dev/net/tun in it */
2241 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2242 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2243
88213476 2244 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 2245 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 2246 struct stat st;
88213476 2247
c6134d3e 2248 from = path_join("/dev/", d);
8967f291
LP		 2249 if (!from)
2250 return log_oom();
2251
c6134d3e 2252 to = path_join(dest, from);
8967f291
LP		 2253 if (!to)
2254 return log_oom();
88213476
LP		 2255
2256 if (stat(from, &st) < 0) {
2257
4a62c710
MS		 2258 if (errno != ENOENT)
2259 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 2260
baaa35ad
ZJS		 2261 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2262 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2263 "%s is not a char or block device, cannot copy.", from);
2264 else {
8dfce114
LP		 2265 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2266
81f5049b 2267 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
8dbf71ec 2268 /* Explicitly warn the user when /dev is already populated. */
41eb4362 2269 if (errno == EEXIST)
8dbf71ec 2270 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
81f5049b
AC		 2271 if (errno != EPERM)
2272 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2273
8dfce114 2274 /* Some systems abusively restrict mknod but allow bind mounts. */
81f5049b
AC		 2275 r = touch(to);
2276 if (r < 0)
2277 return log_error_errno(r, "touch (%s) failed: %m", to);
511a8cfe 2278 r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2279 if (r < 0)
2280 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
81f5049b 2281 }
6278cf60 2282
03cfe0d5
LP		 2283 r = userns_lchown(to, 0, 0);
2284 if (r < 0)
2285 return log_error_errno(r, "chown() of device node %s failed: %m", to);
8dfce114 2286
657ee2d8 2287 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
8dfce114
LP		 2288 if (!dn)
2289 return log_oom();
2290
2291 r = userns_mkdir(dest, dn, 0755, 0, 0);
2292 if (r < 0)
2293 return log_error_errno(r, "Failed to create '%s': %m", dn);
2294
2295 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2296 return log_oom();
2297
c6134d3e 2298 prefixed = path_join(dest, sl);
8dfce114
LP		 2299 if (!prefixed)
2300 return log_oom();
2301
2d9b74ba 2302 t = path_join("..", d);
8dfce114
LP		 2303 if (!t)
2304 return log_oom();
2305
2306 if (symlink(t, prefixed) < 0)
2307 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
88213476 2308 }
88213476
LP		 2309 }
2310
e58a1277
LP		 2311 return r;
2312}
88213476 2313
de40a303 2314static int make_extra_nodes(const char *dest) {
de40a303
LP		 2315 size_t i;
2316 int r;
2317
52f05ef2 2318 BLOCK_WITH_UMASK(0000);
de40a303
LP		 2319
2320 for (i = 0; i < arg_n_extra_nodes; i++) {
2321 _cleanup_free_ char *path = NULL;
2322 DeviceNode *n = arg_extra_nodes + i;
2323
c6134d3e 2324 path = path_join(dest, n->path);
de40a303
LP		 2325 if (!path)
2326 return log_oom();
2327
2328 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2329 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2330
2331 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2332 if (r < 0)
2333 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2334 }
2335
2336 return 0;
2337}
2338
03cfe0d5
LP		 2339static int setup_pts(const char *dest) {
2340 _cleanup_free_ char *options = NULL;
2341 const char *p;
709f6e46 2342 int r;
03cfe0d5 2343
349cc4a5 2344#if HAVE_SELINUX
03cfe0d5
LP		 2345 if (arg_selinux_apifs_context)
2346 (void) asprintf(&options,
3dce8915 2347 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 2348 arg_uid_shift + TTY_GID,
2349 arg_selinux_apifs_context);
2350 else
2351#endif
2352 (void) asprintf(&options,
3dce8915 2353 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 2354 arg_uid_shift + TTY_GID);
f2d88580 2355
03cfe0d5 2356 if (!options)
f2d88580
LP		 2357 return log_oom();
2358
03cfe0d5 2359 /* Mount /dev/pts itself */
cc9fce65 2360 p = prefix_roota(dest, "/dev/pts");
3f692e2e 2361 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e
ZJS		 2362 if (r < 0)
2363 return log_error_errno(r, "Failed to create /dev/pts: %m");
2364
511a8cfe 2365 r = mount_nofollow_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
60e76d48
ZJS		 2366 if (r < 0)
2367 return r;
709f6e46
MS		 2368 r = userns_lchown(p, 0, 0);
2369 if (r < 0)
2370 return log_error_errno(r, "Failed to chown /dev/pts: %m");
03cfe0d5
LP		 2371
2372 /* Create /dev/ptmx symlink */
2373 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 2374 if (symlink("pts/ptmx", p) < 0)
2375 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
709f6e46
MS		 2376 r = userns_lchown(p, 0, 0);
2377 if (r < 0)
2378 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
f2d88580 2379
03cfe0d5
LP		 2380 /* And fix /dev/pts/ptmx ownership */
2381 p = prefix_roota(dest, "/dev/pts/ptmx");
709f6e46
MS		 2382 r = userns_lchown(p, 0, 0);
2383 if (r < 0)
2384 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 2385
f2d88580
LP		 2386 return 0;
2387}
2388
3acc84eb 2389static int setup_stdio_as_dev_console(void) {
5bb1d7fb 2390 _cleanup_close_ int terminal = -EBADF;
e58a1277 2391 int r;
e58a1277 2392
335d2ead
LP		 2393 /* We open the TTY in O_NOCTTY mode, so that we do not become controller yet. We'll do that later
2394 * explicitly, if we are configured to. */
2395 terminal = open_terminal("/dev/console", O_RDWR|O_NOCTTY);
3acc84eb
FB		 2396 if (terminal < 0)
2397 return log_error_errno(terminal, "Failed to open console: %m");
e58a1277 2398
3acc84eb
FB		 2399 /* Make sure we can continue logging to the original stderr, even if
2400 * stderr points elsewhere now */
2401 r = log_dup_console();
2402 if (r < 0)
2403 return log_error_errno(r, "Failed to duplicate stderr: %m");
de40a303 2404
3acc84eb
FB		 2405 /* invalidates 'terminal' on success and failure */
2406 r = rearrange_stdio(terminal, terminal, terminal);
2fef50cd 2407 TAKE_FD(terminal);
f647962d 2408 if (r < 0)
3acc84eb
FB		 2409 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2410
2411 return 0;
2412}
88213476 2413
3acc84eb
FB		 2414static int setup_dev_console(const char *console) {
2415 _cleanup_free_ char *p = NULL;
2416 int r;
a258bf26 2417
3acc84eb
FB		 2418 /* Create /dev/console symlink */
2419 r = path_make_relative("/dev", console, &p);
81f5049b 2420 if (r < 0)
3acc84eb
FB		 2421 return log_error_errno(r, "Failed to create relative path: %m");
2422
2423 if (symlink(p, "/dev/console") < 0)
2424 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
a258bf26 2425
3acc84eb 2426 return 0;
e58a1277
LP		 2427}
2428
8e5430c4
LP		 2429static int setup_keyring(void) {
2430 key_serial_t keyring;
2431
6b000af4
LP		 2432 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2433 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2434 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2435 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2436 * into the container. */
8e5430c4
LP		 2437
2438 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2439 if (keyring == -1) {
2440 if (errno == ENOSYS)
2441 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
065b4774 2442 else if (ERRNO_IS_PRIVILEGE(errno))
8e5430c4
LP		 2443 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2444 else
2445 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2446 }
2447
2448 return 0;
2449}
2450
3652872a
LP		 2451static int setup_credentials(const char *root) {
2452 const char *q;
2453 int r;
2454
2455 if (arg_n_credentials <= 0)
2456 return 0;
2457
2458 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2459 if (r < 0)
2460 return log_error_errno(r, "Failed to create /run/host: %m");
2461
2462 r = userns_mkdir(root, "/run/host/credentials", 0700, 0, 0);
2463 if (r < 0)
2464 return log_error_errno(r, "Failed to create /run/host/credentials: %m");
2465
2466 q = prefix_roota(root, "/run/host/credentials");
511a8cfe 2467 r = mount_nofollow_verbose(LOG_ERR, NULL, q, "ramfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0700");
3652872a
LP		 2468 if (r < 0)
2469 return r;
2470
2471 for (size_t i = 0; i < arg_n_credentials; i++) {
2472 _cleanup_free_ char *j = NULL;
254d1313 2473 _cleanup_close_ int fd = -EBADF;
3652872a
LP		 2474
2475 j = path_join(q, arg_credentials[i].id);
2476 if (!j)
2477 return log_oom();
2478
2479 fd = open(j, O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC|O_NOFOLLOW, 0600);
2480 if (fd < 0)
2481 return log_error_errno(errno, "Failed to create credential file %s: %m", j);
2482
2483 r = loop_write(fd, arg_credentials[i].data, arg_credentials[i].size, /* do_poll= */ false);
2484 if (r < 0)
2485 return log_error_errno(r, "Failed to write credential to file %s: %m", j);
2486
2487 if (fchmod(fd, 0400) < 0)
2488 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", j);
2489
2490 if (arg_userns_mode != USER_NAMESPACE_NO) {
2491 if (fchown(fd, arg_uid_shift, arg_uid_shift) < 0)
2492 return log_error_errno(errno, "Failed to adjust ownership of %s: %m", j);
2493 }
2494 }
2495
2496 if (chmod(q, 0500) < 0)
2497 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", q);
2498
2499 r = userns_lchown(q, 0, 0);
2500 if (r < 0)
2501 return r;
2502
2503 /* Make both mount and superblock read-only now */
511a8cfe 2504 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
3652872a
LP		 2505 if (r < 0)
2506 return r;
2507
511a8cfe 2508 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0500");
3652872a
LP		 2509}
2510
5d9d3fcb 2511static int setup_kmsg(int fd_inner_socket) {
9ec5a93c
LP		 2512 _cleanup_(unlink_and_freep) char *from = NULL;
2513 _cleanup_free_ char *fifo = NULL;
254d1313 2514 _cleanup_close_ int fd = -EBADF;
9ec5a93c 2515 int r;
e58a1277 2516
5d9d3fcb 2517 assert(fd_inner_socket >= 0);
a258bf26 2518
52f05ef2 2519 BLOCK_WITH_UMASK(0000);
a258bf26 2520
30fd9a2d 2521 /* We create the kmsg FIFO as a temporary file in /run, but immediately delete it after bind mounting it to
9ec5a93c
LP		 2522 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2523 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2524 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2525
1eacc470 2526 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
9ec5a93c
LP		 2527 if (r < 0)
2528 return log_error_errno(r, "Failed to generate kmsg path: %m");
e58a1277 2529
9ec5a93c 2530 if (mkfifo(fifo, 0600) < 0)
03cfe0d5 2531 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
9ec5a93c
LP		 2532
2533 from = TAKE_PTR(fifo);
9ec5a93c 2534
511a8cfe 2535 r = mount_nofollow_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
60e76d48
ZJS		 2536 if (r < 0)
2537 return r;
e58a1277 2538
669fc4e5 2539 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
4a62c710
MS		 2540 if (fd < 0)
2541 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 2542
9ec5a93c 2543 /* Store away the fd in the socket, so that it stays open as long as we run the child */
5d9d3fcb 2544 r = send_one_fd(fd_inner_socket, fd, 0);
d9603714
DH		 2545 if (r < 0)
2546 return log_error_errno(r, "Failed to send FIFO fd: %m");
a258bf26 2547
25ea79fe 2548 return 0;
88213476
LP		 2549}
2550
761cf19d 2551struct ExposeArgs {
deff68e7
FW		 2552 union in_addr_union address4;
2553 union in_addr_union address6;
761cf19d
FW		 2554 struct FirewallContext *fw_ctx;
2555};
2556
1c4baffc 2557static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
99534007 2558 struct ExposeArgs *args = ASSERT_PTR(userdata);
6d0b55c2
LP		 2559
2560 assert(rtnl);
2561 assert(m);
6d0b55c2 2562
fb9044cb
LP		 2563 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
2564 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
6d0b55c2
LP		 2565 return 0;
2566}
2567
3a74cea5 2568static int setup_hostname(void) {
c818eef1 2569 int r;
3a74cea5 2570
0c582db0 2571 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
eb91eb18
LP		 2572 return 0;
2573
c818eef1
LP		 2574 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2575 if (r < 0)
2576 return log_error_errno(r, "Failed to set hostname: %m");
3a74cea5 2577
7027ff61 2578 return 0;
3a74cea5
LP		 2579}
2580
57fb9fb5 2581static int setup_journal(const char *directory) {
0f5e1382 2582 _cleanup_free_ char *d = NULL;
5980d463 2583 const char *p, *q;
b2238e38 2584 sd_id128_t this_id;
8054d749 2585 bool try;
57fb9fb5
LP		 2586 int r;
2587
df9a75e4
LP		 2588 /* Don't link journals in ephemeral mode */
2589 if (arg_ephemeral)
2590 return 0;
2591
8054d749
LP		 2592 if (arg_link_journal == LINK_NO)
2593 return 0;
2594
2595 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2596
4d680aee 2597 r = sd_id128_get_machine(&this_id);
f647962d
MS		 2598 if (r < 0)
2599 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee 2600
e01ff70a 2601 if (sd_id128_equal(arg_uuid, this_id)) {
8054d749 2602 log_full(try ? LOG_WARNING : LOG_ERR,
85b55869 2603 "Host and machine ids are equal (%s): refusing to link journals", SD_ID128_TO_STRING(arg_uuid));
8054d749 2604 if (try)
4d680aee 2605 return 0;
df9a75e4 2606 return -EEXIST;
4d680aee
ZJS		 2607 }
2608
369ca6da
ZJS		 2609 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2610 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2611 if (r < 0) {
2612 bool ignore = r == -EROFS && try;
2613 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2614 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2615 return ignore ? 0 : r;
2616 }
2617 }
03cfe0d5 2618
85b55869 2619 p = strjoina("/var/log/journal/", SD_ID128_TO_STRING(arg_uuid));
03cfe0d5 2620 q = prefix_roota(directory, p);
27407a01 2621
e1873695 2622 if (path_is_mount_point(p, NULL, 0) > 0) {
8054d749
LP		 2623 if (try)
2624 return 0;
27407a01 2625
baaa35ad
ZJS		 2626 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2627 "%s: already a mount point, refusing to use for journal", p);
57fb9fb5
LP		 2628 }
2629
e1873695 2630 if (path_is_mount_point(q, NULL, 0) > 0) {
8054d749
LP		 2631 if (try)
2632 return 0;
57fb9fb5 2633
baaa35ad
ZJS		 2634 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2635 "%s: already a mount point, refusing to use for journal", q);
57fb9fb5
LP		 2636 }
2637
2638 r = readlink_and_make_absolute(p, &d);
2639 if (r >= 0) {
3742095b 2640 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
57fb9fb5
LP		 2641 path_equal(d, q)) {
2642
03cfe0d5 2643 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2644 if (r < 0)
709f6e46 2645 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2646 return 0;
57fb9fb5
LP		 2647 }
2648
4a62c710
MS		 2649 if (unlink(p) < 0)
2650 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 2651 } else if (r == -EINVAL) {
2652
2653 if (arg_link_journal == LINK_GUEST &&
2654 rmdir(p) < 0) {
2655
27407a01
ZJS		 2656 if (errno == ENOTDIR) {
2657 log_error("%s already exists and is neither a symlink nor a directory", p);
2658 return r;
4314d33f
MS		 2659 } else
2660 return log_error_errno(errno, "Failed to remove %s: %m", p);
57fb9fb5 2661 }
4314d33f
MS		 2662 } else if (r != -ENOENT)
2663 return log_error_errno(r, "readlink(%s) failed: %m", p);
57fb9fb5
LP		 2664
2665 if (arg_link_journal == LINK_GUEST) {
2666
2667 if (symlink(q, p) < 0) {
8054d749 2668 if (try) {
56f64d95 2669 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90 2670 return 0;
4314d33f
MS		 2671 } else
2672 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
57fb9fb5
LP		 2673 }
2674
03cfe0d5 2675 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2676 if (r < 0)
709f6e46 2677 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2678 return 0;
57fb9fb5
LP		 2679 }
2680
2681 if (arg_link_journal == LINK_HOST) {
ccddd104 2682 /* don't create parents here — if the host doesn't have
574edc90 2683 * permanent journal set up, don't force it here */
ba8e6c4d 2684
3f692e2e 2685 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e 2686 if (r < 0 && r != -EEXIST) {
8054d749 2687 if (try) {
dae8b82e 2688 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
574edc90 2689 return 0;
4314d33f 2690 } else
dae8b82e 2691 return log_error_errno(r, "Failed to create %s: %m", p);
57fb9fb5
LP		 2692 }
2693
27407a01
ZJS		 2694 } else if (access(p, F_OK) < 0)
2695 return 0;
57fb9fb5 2696
db55bbf2 2697 if (dir_is_empty(q, /* ignore_hidden_or_backup= */ false) == 0)
cdb2b9d0
LP		 2698 log_warning("%s is not empty, proceeding anyway.", q);
2699
03cfe0d5 2700 r = userns_mkdir(directory, p, 0755, 0, 0);
709f6e46
MS		 2701 if (r < 0)
2702 return log_error_errno(r, "Failed to create %s: %m", q);
57fb9fb5 2703
511a8cfe 2704 r = mount_nofollow_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
60e76d48 2705 if (r < 0)
4a62c710 2706 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 2707
27407a01 2708 return 0;
57fb9fb5
LP		 2709}
2710
de40a303
LP		 2711static int drop_capabilities(uid_t uid) {
2712 CapabilityQuintet q;
2713
2714 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2715 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2716 * arg_caps_retain. */
2717
2718 if (capability_quintet_is_set(&arg_full_capabilities)) {
2719 q = arg_full_capabilities;
2720
f5fbe71d 2721 if (q.bounding == UINT64_MAX)
de40a303
LP		 2722 q.bounding = uid == 0 ? arg_caps_retain : 0;
2723
f5fbe71d 2724 if (q.effective == UINT64_MAX)
de40a303
LP		 2725 q.effective = uid == 0 ? q.bounding : 0;
2726
f5fbe71d 2727 if (q.inheritable == UINT64_MAX)
88fc9c9b 2728 q.inheritable = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2729
f5fbe71d 2730 if (q.permitted == UINT64_MAX)
88fc9c9b 2731 q.permitted = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2732
f5fbe71d 2733 if (q.ambient == UINT64_MAX && ambient_capabilities_supported())
88fc9c9b 2734 q.ambient = arg_caps_ambient;
f66ad460
AZ		 2735
2736 if (capability_quintet_mangle(&q))
2737 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2738
2739 } else {
de40a303
LP		 2740 q = (CapabilityQuintet) {
2741 .bounding = arg_caps_retain,
2742 .effective = uid == 0 ? arg_caps_retain : 0,
88fc9c9b
TH		 2743 .inheritable = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2744 .permitted = uid == 0 ? arg_caps_retain : arg_caps_ambient,
f5fbe71d 2745 .ambient = ambient_capabilities_supported() ? arg_caps_ambient : UINT64_MAX,
de40a303
LP		 2746 };
2747
f66ad460
AZ		 2748 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2749 * in order to maintain the same behavior as systemd < 242. */
2750 if (capability_quintet_mangle(&q))
0ccdaa79
JT		 2751 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2752 "Some capabilities will not be set because they are not in the current bounding set.");
f66ad460
AZ		 2753
2754 }
2755
de40a303 2756 return capability_quintet_enforce(&q);
88213476
LP		 2757}
2758
db999e0f
LP		 2759static int reset_audit_loginuid(void) {
2760 _cleanup_free_ char *p = NULL;
2761 int r;
2762
0c582db0 2763 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
db999e0f
LP		 2764 return 0;
2765
2766 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 2767 if (r == -ENOENT)
db999e0f 2768 return 0;
f647962d
MS		 2769 if (r < 0)
2770 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 2771
2772 /* Already reset? */
2773 if (streq(p, "4294967295"))
2774 return 0;
2775
57512c89 2776 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
db999e0f 2777 if (r < 0) {
10a87006
LP		 2778 log_error_errno(r,
2779 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2780 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2781 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2782 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2783 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 2784
db999e0f 2785 sleep(5);
77b6e194 2786 }
db999e0f
LP		 2787
2788 return 0;
77b6e194
LP		 2789}
2790
e79581dd 2791static int mount_tunnel_dig(const char *root) {
785890ac 2792 const char *p, *q;
709f6e46 2793 int r;
785890ac
LP		 2794
2795 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2796 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 2797 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 2798 (void) mkdir_p(p, 0600);
2799
5a27b395 2800 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
709f6e46 2801 if (r < 0)
5a27b395 2802 return log_error_errno(r, "Failed to create /run/host: %m");
03cfe0d5 2803
e79581dd 2804 r = userns_mkdir(root, NSPAWN_MOUNT_TUNNEL, 0600, 0, 0);
709f6e46 2805 if (r < 0)
e79581dd 2806 return log_error_errno(r, "Failed to create "NSPAWN_MOUNT_TUNNEL": %m");
03cfe0d5 2807
e79581dd 2808 q = prefix_roota(root, NSPAWN_MOUNT_TUNNEL);
511a8cfe 2809 r = mount_nofollow_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2810 if (r < 0)
2811 return r;
785890ac 2812
511a8cfe 2813 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
60e76d48
ZJS		 2814 if (r < 0)
2815 return r;
785890ac 2816
e79581dd
CB		 2817 return 0;
2818}
2819
2820static int mount_tunnel_open(void) {
2821 int r;
2822
2823 r = mount_follow_verbose(LOG_ERR, NULL, NSPAWN_MOUNT_TUNNEL, NULL, MS_SLAVE, NULL);
2824 if (r < 0)
2825 return r;
2826
2827 return 0;
785890ac
LP		 2828}
2829
317feb4d 2830static int setup_machine_id(const char *directory) {
691675ba
LP		 2831 const char *etc_machine_id;
2832 sd_id128_t id;
3bbaff3e 2833 int r;
e01ff70a 2834
317feb4d
LP		 2835 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2836 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2837 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2838 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2839 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2840 * container behaves nicely). */
2841
e01ff70a
MS		 2842 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2843
057bf780 2844 r = id128_read(etc_machine_id, ID128_FORMAT_PLAIN, &id);
317feb4d 2845 if (r < 0) {
74e795ee 2846 if (!ERRNO_IS_MACHINE_ID_UNSET(r)) /* If the file is missing, empty, or uninitialized, we don't mind */
317feb4d 2847 return log_error_errno(r, "Failed to read machine ID from container image: %m");
691675ba 2848
317feb4d
LP		 2849 if (sd_id128_is_null(arg_uuid)) {
2850 r = sd_id128_randomize(&arg_uuid);
2851 if (r < 0)
2852 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2853 }
2854 } else {
baaa35ad
ZJS		 2855 if (sd_id128_is_null(id))
2856 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2857 "Machine ID in container image is zero, refusing.");
e01ff70a 2858
317feb4d
LP		 2859 arg_uuid = id;
2860 }
691675ba 2861
e01ff70a
MS		 2862 return 0;
2863}
2864
7336138e
LP		 2865static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2866 int r;
2867
2868 assert(directory);
2869
6c045a99 2870 if (arg_userns_mode == USER_NAMESPACE_NO || arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_CHOWN)
7336138e
LP		 2871 return 0;
2872
2873 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2874 if (r == -EOPNOTSUPP)
2875 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2876 if (r == -EBADE)
2877 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2878 if (r < 0)
2879 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2880 if (r == 0)
2881 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2882 else
2883 log_debug("Patched directory tree to match UID/GID range.");
2884
2885 return r;
2886}
2887
113cea80 2888/*
6d416b9c
LS		 2889 * Return values:
2890 * < 0 : wait_for_terminate() failed to get the state of the
2891 * container, the container was terminated by a signal, or
2892 * failed for an unknown reason. No change is made to the
2893 * container argument.
2894 * > 0 : The program executed in the container terminated with an
2895 * error. The exit code of the program executed in the
919699ec
LP		 2896 * container is returned. The container argument has been set
2897 * to CONTAINER_TERMINATED.
6d416b9c
LS		 2898 * 0 : The container is being rebooted, has been shut down or exited
2899 * successfully. The container argument has been set to either
2900 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 2901 *
6d416b9c
LS		 2902 * That is, success is indicated by a return value of zero, and an
2903 * error is indicated by a non-zero value.
113cea80
DH		 2904 */
2905static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 2906 siginfo_t status;
919699ec 2907 int r;
113cea80
DH		 2908
2909 r = wait_for_terminate(pid, &status);
f647962d
MS		 2910 if (r < 0)
2911 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 2912
2913 switch (status.si_code) {
fddbb89c 2914
113cea80 2915 case CLD_EXITED:
b5a2179b 2916 if (status.si_status == 0)
919699ec 2917 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
b5a2179b 2918 else
919699ec 2919 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 2920
919699ec
LP		 2921 *container = CONTAINER_TERMINATED;
2922 return status.si_status;
113cea80
DH		 2923
2924 case CLD_KILLED:
2925 if (status.si_status == SIGINT) {
919699ec 2926 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 2927 *container = CONTAINER_TERMINATED;
919699ec
LP		 2928 return 0;
2929
113cea80 2930 } else if (status.si_status == SIGHUP) {
919699ec 2931 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 2932 *container = CONTAINER_REBOOTED;
919699ec 2933 return 0;
113cea80 2934 }
919699ec 2935
4831981d 2936 _fallthrough_;
113cea80 2937 case CLD_DUMPED:
baaa35ad
ZJS		 2938 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2939 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
113cea80
DH		 2940
2941 default:
baaa35ad
ZJS		 2942 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2943 "Container %s failed due to unknown reason.", arg_machine);
113cea80 2944 }
113cea80
DH		 2945}
2946
023fb90b
LP		 2947static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2948 pid_t pid;
2949
4a0b58c4 2950 pid = PTR_TO_PID(userdata);
023fb90b 2951 if (pid > 0) {
c6c8f6e2 2952 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 2953 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2954 sd_event_source_set_userdata(s, NULL);
2955 return 0;
2956 }
2957 }
2958
2959 sd_event_exit(sd_event_source_get_event(s), 0);
2960 return 0;
2961}
2962
6916b164 2963static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
abdb9b08
LP		 2964 pid_t pid;
2965
2966 assert(s);
2967 assert(ssi);
2968
2969 pid = PTR_TO_PID(userdata);
2970
6916b164
AU		 2971 for (;;) {
2972 siginfo_t si = {};
abdb9b08 2973
6916b164
AU		 2974 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2975 return log_error_errno(errno, "Failed to waitid(): %m");
2976 if (si.si_pid == 0) /* No pending children. */
2977 break;
abdb9b08 2978 if (si.si_pid == pid) {
6916b164
AU		 2979 /* The main process we care for has exited. Return from
2980 * signal handler but leave the zombie. */
2981 sd_event_exit(sd_event_source_get_event(s), 0);
2982 break;
2983 }
abdb9b08 2984
6916b164
AU		 2985 /* Reap all other children. */
2986 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2987 }
2988
2989 return 0;
2990}
2991
abdb9b08
LP		 2992static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2993 pid_t pid;
2994
2995 assert(m);
2996
2997 pid = PTR_TO_PID(userdata);
2998
2999 if (arg_kill_signal > 0) {
3000 log_info("Container termination requested. Attempting to halt container.");
3001 (void) kill(pid, arg_kill_signal);
3002 } else {
3003 log_info("Container termination requested. Exiting.");
3004 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
3005 }
3006
3007 return 0;
3008}
3009
ec16945e 3010static int determine_names(void) {
1b9cebf6 3011 int r;
ec16945e 3012
c1521918
LP		 3013 if (arg_template && !arg_directory && arg_machine) {
3014
3015 /* If --template= was specified then we should not
3016 * search for a machine, but instead create a new one
3017 * in /var/lib/machine. */
3018
657ee2d8 3019 arg_directory = path_join("/var/lib/machines", arg_machine);
c1521918
LP		 3020 if (!arg_directory)
3021 return log_oom();
3022 }
3023
ec16945e 3024 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 3025 if (arg_machine) {
3026 _cleanup_(image_unrefp) Image *i = NULL;
3027
d577d4a4 3028 r = image_find(IMAGE_MACHINE, arg_machine, NULL, &i);
3a6ce860
LP		 3029 if (r == -ENOENT)
3030 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
1b9cebf6
LP		 3031 if (r < 0)
3032 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
1b9cebf6 3033
eb38edce 3034 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
0f03c2a4 3035 r = free_and_strdup(&arg_image, i->path);
1b9cebf6 3036 else
0f03c2a4 3037 r = free_and_strdup(&arg_directory, i->path);
1b9cebf6 3038 if (r < 0)
0f3be6ca 3039 return log_oom();
1b9cebf6 3040
aee327b8
LP		 3041 if (!arg_ephemeral)
3042 arg_read_only = arg_read_only || i->read_only;
d7249575
LP		 3043 } else {
3044 r = safe_getcwd(&arg_directory);
3045 if (r < 0)
3046 return log_error_errno(r, "Failed to determine current directory: %m");
3047 }
ec16945e 3048
c6147113
LP		 3049 if (!arg_directory && !arg_image)
3050 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
ec16945e
LP		 3051 }
3052
3053 if (!arg_machine) {
b9ba4dab
LP		 3054 if (arg_directory && path_equal(arg_directory, "/"))
3055 arg_machine = gethostname_malloc();
e9b88a6d
LP		 3056 else if (arg_image) {
3057 char *e;
4827ab48 3058
b36e39d2
LP		 3059 r = path_extract_filename(arg_image, &arg_machine);
3060 if (r < 0)
3061 return log_error_errno(r, "Failed to extract file name from '%s': %m", arg_image);
4827ab48 3062
e9b88a6d
LP		 3063 /* Truncate suffix if there is one */
3064 e = endswith(arg_machine, ".raw");
3065 if (e)
3066 *e = 0;
b36e39d2
LP		 3067 } else {
3068 r = path_extract_filename(arg_directory, &arg_machine);
3069 if (r < 0)
3070 return log_error_errno(r, "Failed to extract file name from '%s': %m", arg_directory);
3071 }
ec16945e 3072
ae691c1d 3073 hostname_cleanup(arg_machine);
52ef5dd7 3074 if (!hostname_is_valid(arg_machine, 0))
c6147113 3075 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
b9ba4dab 3076
3603f151
LB		 3077 /* Copy the machine name before the random suffix is added below, otherwise we won't be able
3078 * to match fixed config file names. */
3079 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3080 if (!arg_settings_filename)
3081 return log_oom();
3082
e9b88a6d
LP		 3083 /* Add a random suffix when this is an ephemeral machine, so that we can run many
3084 * instances at once without manually having to specify -M each time. */
3085 if (arg_ephemeral)
3086 if (strextendf(&arg_machine, "-%016" PRIx64, random_u64()) < 0)
b9ba4dab 3087 return log_oom();
3603f151
LB		 3088 } else {
3089 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3090 if (!arg_settings_filename)
3091 return log_oom();
ec16945e
LP		 3092 }
3093
3094 return 0;
3095}
3096
8d4aa2bb 3097static int chase_symlinks_and_update(char **p, unsigned flags) {
3f342ec4
LP		 3098 char *chased;
3099 int r;
3100
3101 assert(p);
3102
3103 if (!*p)
3104 return 0;
3105
a5648b80 3106 r = chase_symlinks(*p, NULL, flags, &chased, NULL);
3f342ec4
LP		 3107 if (r < 0)
3108 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
3109
a5648b80 3110 return free_and_replace(*p, chased);
3f342ec4
LP		 3111}
3112
03cfe0d5 3113static int determine_uid_shift(const char *directory) {
6dac160c 3114
0de7acce 3115 if (arg_userns_mode == USER_NAMESPACE_NO) {
03cfe0d5 3116 arg_uid_shift = 0;
6dac160c 3117 return 0;
03cfe0d5 3118 }
6dac160c
LP		 3119
3120 if (arg_uid_shift == UID_INVALID) {
3121 struct stat st;
3122
993da6d4
LP		 3123 /* Read the UID shift off the image. Maybe we can reuse this to avoid chowning. */
3124
3125 if (stat(directory, &st) < 0)
03cfe0d5 3126 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 3127
3128 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
3129
baaa35ad
ZJS		 3130 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
3131 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3132 "UID and GID base of %s don't match.", directory);
6dac160c
LP		 3133
3134 arg_uid_range = UINT32_C(0x10000);
f61c7f88
LP		 3135
3136 if (arg_uid_shift != 0) {
3137 /* If the image is shifted already, then we'll fall back to classic chowning, for
3138 * compatibility (and simplicity), or refuse if mapping is explicitly requested. */
3139
3140 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_AUTO) {
3141 log_debug("UID base of %s is non-zero, not using UID mapping.", directory);
3142 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3143 } else if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_MAP)
3144 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3145 "UID base of %s is not zero, UID mapping not supported.", directory);
3146 }
6dac160c
LP		 3147 }
3148
58e13de5
LP		 3149 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
3150 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID base too high for UID range.");
6dac160c 3151
6dac160c
LP		 3152 return 0;
3153}
3154
de40a303
LP		 3155static unsigned long effective_clone_ns_flags(void) {
3156 unsigned long flags = arg_clone_ns_flags;
3157
3158 if (arg_private_network)
3159 flags |= CLONE_NEWNET;
3160 if (arg_use_cgns)
3161 flags |= CLONE_NEWCGROUP;
3162 if (arg_userns_mode != USER_NAMESPACE_NO)
3163 flags |= CLONE_NEWUSER;
3164
3165 return flags;
3166}
3167
3168static int patch_sysctl(void) {
3169
3170 /* This table is inspired by runc's sysctl() function */
3171 static const struct {
3172 const char *key;
3173 bool prefix;
3174 unsigned long clone_flags;
3175 } safe_sysctl[] = {
3176 { "kernel.hostname", false, CLONE_NEWUTS },
3177 { "kernel.domainname", false, CLONE_NEWUTS },
3178 { "kernel.msgmax", false, CLONE_NEWIPC },
3179 { "kernel.msgmnb", false, CLONE_NEWIPC },
3180 { "kernel.msgmni", false, CLONE_NEWIPC },
3181 { "kernel.sem", false, CLONE_NEWIPC },
3182 { "kernel.shmall", false, CLONE_NEWIPC },
3183 { "kernel.shmmax", false, CLONE_NEWIPC },
3184 { "kernel.shmmni", false, CLONE_NEWIPC },
3185 { "fs.mqueue.", true, CLONE_NEWIPC },
3186 { "net.", true, CLONE_NEWNET },
3187 };
3188
3189 unsigned long flags;
de40a303
LP		 3190 int r;
3191
3192 flags = effective_clone_ns_flags();
3193
3194 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
3195 bool good = false;
3196 size_t i;
3197
3198 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
3199
3200 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
3201 continue;
3202
3203 if (safe_sysctl[i].prefix)
3204 good = startswith(*k, safe_sysctl[i].key);
3205 else
3206 good = streq(*k, safe_sysctl[i].key);
3207
3208 if (good)
3209 break;
3210 }
3211
c6147113
LP		 3212 if (!good)
3213 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
de40a303
LP		 3214
3215 r = sysctl_write(*k, *v);
3216 if (r < 0)
3217 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
3218 }
3219
3220 return 0;
3221}
3222
03cfe0d5
LP		 3223static int inner_child(
3224 Barrier *barrier,
3225 const char *directory,
5d9d3fcb 3226 int fd_inner_socket,
e1bb4b0d
LB		 3227 FDSet *fds,
3228 char **os_release_pairs) {
69c79d3c 3229
03cfe0d5 3230 _cleanup_free_ char *home = NULL;
88614c8a 3231 size_t n_env = 1;
4ab3d29f
ZJS		 3232 char *envp[] = {
3233 (char*) "PATH=" DEFAULT_PATH_COMPAT,
6aadfa4c 3234 NULL, /* container */
03cfe0d5
LP		 3235 NULL, /* TERM */
3236 NULL, /* HOME */
3237 NULL, /* USER */
3238 NULL, /* LOGNAME */
3239 NULL, /* container_uuid */
3240 NULL, /* LISTEN_FDS */
3241 NULL, /* LISTEN_PID */
9c1e04d0 3242 NULL, /* NOTIFY_SOCKET */
3652872a 3243 NULL, /* CREDENTIALS_DIRECTORY */
b626f695 3244 NULL, /* LANG */
03cfe0d5
LP		 3245 NULL
3246 };
1a68e1e5 3247 const char *exec_target;
2371271c 3248 _cleanup_strv_free_ char **env_use = NULL;
de40a303 3249 int r, which_failed;
88213476 3250
b37469d7
LP		 3251 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
3252 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
3253 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
3254 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
3255 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
3256 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
3257 * namespace.
3258 *
3259 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
3260 * unshare(). See below. */
3261
03cfe0d5
LP		 3262 assert(barrier);
3263 assert(directory);
5d9d3fcb 3264 assert(fd_inner_socket >= 0);
88213476 3265
de40a303
LP		 3266 log_debug("Inner child is initializing.");
3267
0de7acce 3268 if (arg_userns_mode != USER_NAMESPACE_NO) {
03cfe0d5
LP		 3269 /* Tell the parent, that it now can write the UID map. */
3270 (void) barrier_place(barrier); /* #1 */
7027ff61 3271
03cfe0d5 3272 /* Wait until the parent wrote the UID map */
baaa35ad 3273 if (!barrier_place_and_sync(barrier)) /* #2 */
2a2e78e9 3274 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
88213476 3275
2a2e78e9
LP		 3276 /* Become the new root user inside our namespace */
3277 r = reset_uid_gid();
3278 if (r < 0)
3279 return log_error_errno(r, "Couldn't become new root: %m");
3280
3281 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
3282 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
3283 * propagation, but simply create new peer groups for all our mounts). */
511a8cfe 3284 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
2a2e78e9
LP		 3285 if (r < 0)
3286 return r;
3287 }
6d66bd3b 3288
0de7acce 3289 r = mount_all(NULL,
4f086aab 3290 arg_mount_settings | MOUNT_IN_USERNS,
0de7acce 3291 arg_uid_shift,
0de7acce 3292 arg_selinux_apifs_context);
03cfe0d5
LP		 3293 if (r < 0)
3294 return r;
3295
04413780
ZJS		 3296 if (!arg_network_namespace_path && arg_private_network) {
3297 r = unshare(CLONE_NEWNET);
3298 if (r < 0)
3299 return log_error_errno(errno, "Failed to unshare network namespace: %m");
75116558
PS		 3300
3301 /* Tell the parent that it can setup network interfaces. */
3302 (void) barrier_place(barrier); /* #3 */
04413780
ZJS		 3303 }
3304
4f086aab 3305 r = mount_sysfs(NULL, arg_mount_settings);
d8fc6a00
LP		 3306 if (r < 0)
3307 return r;
3308
03cfe0d5
LP		 3309 /* Wait until we are cgroup-ified, so that we
3310 * can mount the right cgroup path writable */
baaa35ad
ZJS		 3311 if (!barrier_place_and_sync(barrier)) /* #4 */
3312 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3313 "Parent died too early");
88213476 3314
489fae52 3315 if (arg_use_cgns) {
0996ef00
CB		 3316 r = unshare(CLONE_NEWCGROUP);
3317 if (r < 0)
04413780 3318 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
0996ef00
CB		 3319 r = mount_cgroups(
3320 "",
3321 arg_unified_cgroup_hierarchy,
3322 arg_userns_mode != USER_NAMESPACE_NO,
3323 arg_uid_shift,
3324 arg_uid_range,
5a8ff0e6 3325 arg_selinux_apifs_context,
ada54120 3326 true);
1433e0f2 3327 } else
0996ef00 3328 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
1433e0f2
LP		 3329 if (r < 0)
3330 return r;
ec16945e 3331
1e4f1671 3332 r = setup_boot_id();
03cfe0d5
LP		 3333 if (r < 0)
3334 return r;
ec16945e 3335
5d9d3fcb 3336 r = setup_kmsg(fd_inner_socket);
03cfe0d5
LP		 3337 if (r < 0)
3338 return r;
ec16945e 3339
de40a303
LP		 3340 r = mount_custom(
3341 "/",
3342 arg_custom_mounts,
3343 arg_n_custom_mounts,
de40a303 3344 0,
c0c8f718 3345 0,
de40a303 3346 arg_selinux_apifs_context,
5f0a6347 3347 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
de40a303
LP		 3348 if (r < 0)
3349 return r;
3350
03cfe0d5
LP		 3351 if (setsid() < 0)
3352 return log_error_errno(errno, "setsid() failed: %m");
3353
3354 if (arg_private_network)
df883de9 3355 (void) loopback_setup();
03cfe0d5 3356
7a8f6325 3357 if (arg_expose_ports) {
b07ee903 3358 r = expose_port_send_rtnl(fd_inner_socket);
7a8f6325
LP		 3359 if (r < 0)
3360 return r;
7a8f6325 3361 }
03cfe0d5 3362
3acc84eb 3363 if (arg_console_mode != CONSOLE_PIPE) {
5bb1d7fb 3364 _cleanup_close_ int master = -EBADF;
3acc84eb
FB		 3365 _cleanup_free_ char *console = NULL;
3366
3367 /* Allocate a pty and make it available as /dev/console. */
dc98caea 3368 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3acc84eb 3369 if (master < 0)
dc98caea 3370 return log_error_errno(master, "Failed to allocate a pty: %m");
3acc84eb
FB		 3371
3372 r = setup_dev_console(console);
3373 if (r < 0)
105a1a36 3374 return log_error_errno(r, "Failed to set up /dev/console: %m");
3acc84eb 3375
bb1aa185 3376 r = send_one_fd(fd_inner_socket, master, 0);
3acc84eb
FB		 3377 if (r < 0)
3378 return log_error_errno(r, "Failed to send master fd: %m");
3acc84eb
FB		 3379
3380 r = setup_stdio_as_dev_console();
3381 if (r < 0)
3382 return r;
3383 }
3384
de40a303
LP		 3385 r = patch_sysctl();
3386 if (r < 0)
3387 return r;
3388
81f345df
LP		 3389 if (arg_oom_score_adjust_set) {
3390 r = set_oom_score_adjust(arg_oom_score_adjust);
3391 if (r < 0)
3392 return log_error_errno(r, "Failed to adjust OOM score: %m");
3393 }
3394
0985c7c4
ZJS		 3395 if (arg_cpu_set.set)
3396 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
d107bb7d
LP		 3397 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3398
c818eef1 3399 (void) setup_hostname();
03cfe0d5 3400
050f7277 3401 if (arg_personality != PERSONALITY_INVALID) {
21022b9d
LP		 3402 r = safe_personality(arg_personality);
3403 if (r < 0)
3404 return log_error_errno(r, "personality() failed: %m");
4c27749b
LP		 3405#ifdef ARCHITECTURE_SECONDARY
3406 } else if (arg_architecture == ARCHITECTURE_SECONDARY) {
21022b9d
LP		 3407 r = safe_personality(PER_LINUX32);
3408 if (r < 0)
3409 return log_error_errno(r, "personality() failed: %m");
4c27749b
LP		 3410#endif
3411 } else if (arg_architecture >= 0 && arg_architecture != native_architecture())
3412 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3413 "Selected architecture '%s' not supported locally, refusing.",
3414 architecture_to_string(arg_architecture));
03cfe0d5 3415
de40a303
LP		 3416 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3417 if (r < 0)
3418 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3419
3420#if HAVE_SECCOMP
3421 if (arg_seccomp) {
3422
3423 if (is_seccomp_available()) {
3424
3425 r = seccomp_load(arg_seccomp);
7bc5e0b1 3426 if (ERRNO_IS_SECCOMP_FATAL(r))
de40a303
LP		 3427 return log_error_errno(r, "Failed to install seccomp filter: %m");
3428 if (r < 0)
3429 log_debug_errno(r, "Failed to install seccomp filter: %m");
3430 }
3431 } else
3432#endif
3433 {
6b000af4 3434 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
de40a303
LP		 3435 if (r < 0)
3436 return r;
3437 }
3438
4a4654e0 3439 if (arg_suppress_sync) {
20e458ae 3440#if HAVE_SECCOMP
4a4654e0
LP		 3441 r = seccomp_suppress_sync();
3442 if (r < 0)
3443 log_debug_errno(r, "Failed to install sync() suppression seccomp filter, ignoring: %m");
20e458ae 3444#else
2db32618 3445 log_debug("systemd is built without SECCOMP support. Ignoring --suppress-sync= command line option and SuppressSync= setting.");
20e458ae 3446#endif
4a4654e0
LP		 3447 }
3448
349cc4a5 3449#if HAVE_SELINUX
03cfe0d5 3450 if (arg_selinux_context)
2ed96880 3451 if (setexeccon(arg_selinux_context) < 0)
03cfe0d5
LP		 3452 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3453#endif
3454
de40a303
LP		 3455 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3456 * if we need to later on. */
3457 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3458 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3459
3460 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3462d773 3461 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids, arg_console_mode != CONSOLE_PIPE);
de40a303 3462 else
3462d773 3463 r = change_uid_gid(arg_user, arg_console_mode != CONSOLE_PIPE, &home);
03cfe0d5
LP		 3464 if (r < 0)
3465 return r;
3466
de40a303
LP		 3467 r = drop_capabilities(getuid());
3468 if (r < 0)
3469 return log_error_errno(r, "Dropping capabilities failed: %m");
3470
66edd963
LP		 3471 if (arg_no_new_privileges)
3472 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3473 return log_error_errno(errno, "Failed to disable new privileges: %m");
3474
6aadfa4c
ILG		 3475 /* LXC sets container=lxc, so follow the scheme here */
3476 envp[n_env++] = strjoina("container=", arg_container_service_name);
3477
03cfe0d5
LP		 3478 envp[n_env] = strv_find_prefix(environ, "TERM=");
3479 if (envp[n_env])
313cefa1 3480 n_env++;
03cfe0d5 3481
de40a303 3482 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f 3483 if (asprintf(envp + n_env++, "HOME=%s", home ?: "/root") < 0)
de40a303
LP		 3484 return log_oom();
3485
3486 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f
ZJS		 3487 if (asprintf(envp + n_env++, "USER=%s", arg_user ?: "root") < 0 ||
3488 asprintf(envp + n_env++, "LOGNAME=%s", arg_user ? arg_user : "root") < 0)
de40a303 3489 return log_oom();
03cfe0d5 3490
3bbaff3e 3491 assert(!sd_id128_is_null(arg_uuid));
03cfe0d5 3492
b7416360 3493 if (asprintf(envp + n_env++, "container_uuid=%s", SD_ID128_TO_UUID_STRING(arg_uuid)) < 0)
e01ff70a 3494 return log_oom();
03cfe0d5
LP		 3495
3496 if (fdset_size(fds) > 0) {
3497 r = fdset_cloexec(fds, false);
3498 if (r < 0)
3499 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3500
4ab3d29f
ZJS		 3501 if ((asprintf(envp + n_env++, "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3502 (asprintf(envp + n_env++, "LISTEN_PID=1") < 0))
03cfe0d5
LP		 3503 return log_oom();
3504 }
4ab3d29f 3505 if (asprintf(envp + n_env++, "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
9c1e04d0 3506 return log_oom();
03cfe0d5 3507
3652872a
LP		 3508 if (arg_n_credentials > 0) {
3509 envp[n_env] = strdup("CREDENTIALS_DIRECTORY=/run/host/credentials");
3510 if (!envp[n_env])
3511 return log_oom();
3512 n_env++;
3513 }
3514
b626f695 3515 if (arg_start_mode != START_BOOT) {
a22f5186 3516 envp[n_env] = strdup("LANG=" SYSTEMD_NSPAWN_LOCALE);
b626f695
DDM		 3517 if (!envp[n_env])
3518 return log_oom();
3519 n_env++;
3520 }
3521
4ab3d29f 3522 env_use = strv_env_merge(envp, os_release_pairs, arg_setenv);
2371271c
TG		 3523 if (!env_use)
3524 return log_oom();
03cfe0d5
LP		 3525
3526 /* Let the parent know that we are ready and
3527 * wait until the parent is ready with the
3528 * setup, too... */
baaa35ad 3529 if (!barrier_place_and_sync(barrier)) /* #5 */
335d2ead 3530 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
03cfe0d5 3531
5f932eb9
LP		 3532 if (arg_chdir)
3533 if (chdir(arg_chdir) < 0)
3534 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3535
7732f92b 3536 if (arg_start_mode == START_PID2) {
75bf701f 3537 r = stub_pid1(arg_uuid);
7732f92b
LP		 3538 if (r < 0)
3539 return r;
3540 }
3541
335d2ead
LP		 3542 if (arg_console_mode != CONSOLE_PIPE) {
3543 /* So far our pty wasn't controlled by any process. Finally, it's time to change that, if we
3544 * are configured for that. Acquire it as controlling tty. */
3545 if (ioctl(STDIN_FILENO, TIOCSCTTY) < 0)
3546 return log_error_errno(errno, "Failed to acquire controlling TTY: %m");
3547 }
3548
de40a303
LP		 3549 log_debug("Inner child completed, invoking payload.");
3550
8ca082b4
LP		 3551 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3552 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3553 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
03cfe0d5 3554 log_close();
8ca082b4
LP		 3555 log_set_open_when_needed(true);
3556
03cfe0d5
LP		 3557 (void) fdset_close_others(fds);
3558
7732f92b 3559 if (arg_start_mode == START_BOOT) {
03cfe0d5
LP		 3560 char **a;
3561 size_t m;
3562
3563 /* Automatically search for the init system */
3564
75f32f04
ZJS		 3565 m = strv_length(arg_parameters);
3566 a = newa(char*, m + 2);
3567 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3568 a[1 + m] = NULL;
03cfe0d5 3569
a5096641
LP		 3570 FOREACH_STRING(init,
3571 "/usr/lib/systemd/systemd",
3572 "/lib/systemd/systemd",
3573 "/sbin/init") {
3574 a[0] = (char*) init;
3575 execve(a[0], a, env_use);
3576 }
ced58da7
LP		 3577
3578 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
1a68e1e5 3579 } else if (!strv_isempty(arg_parameters)) {
b6b180b7
LP		 3580 const char *dollar_path;
3581
1a68e1e5 3582 exec_target = arg_parameters[0];
b6b180b7
LP		 3583
3584 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3585 * binary. */
3586 dollar_path = strv_env_get(env_use, "PATH");
3587 if (dollar_path) {
6f646e01 3588 if (setenv("PATH", dollar_path, 1) < 0)
b6b180b7
LP		 3589 return log_error_errno(errno, "Failed to update $PATH: %m");
3590 }
3591
f757855e 3592 execvpe(arg_parameters[0], arg_parameters, env_use);
1a68e1e5 3593 } else {
5f932eb9 3594 if (!arg_chdir)
d929b0f9
ZJS		 3595 /* If we cannot change the directory, we'll end up in /, that is expected. */
3596 (void) chdir(home ?: "/root");
5f932eb9 3597
53350c7b 3598 execle(DEFAULT_USER_SHELL, "-" DEFAULT_USER_SHELL_NAME, NULL, env_use);
3599 if (!streq(DEFAULT_USER_SHELL, "/bin/bash"))
3600 execle("/bin/bash", "-bash", NULL, env_use);
3601 if (!streq(DEFAULT_USER_SHELL, "/bin/sh"))
3602 execle("/bin/sh", "-sh", NULL, env_use);
ced58da7 3603
53350c7b 3604 exec_target = DEFAULT_USER_SHELL ", /bin/bash, /bin/sh";
03cfe0d5
LP		 3605 }
3606
8ca082b4 3607 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
03cfe0d5
LP		 3608}
3609
e96ceaba 3610static int setup_notify_child(void) {
254d1313 3611 _cleanup_close_ int fd = -EBADF;
1eb874b9 3612 static const union sockaddr_union sa = {
44ed5214
LP		 3613 .un.sun_family = AF_UNIX,
3614 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
9c1e04d0
AP		 3615 };
3616 int r;
3617
3618 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3619 if (fd < 0)
3620 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3621
3622 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
fbda85b0 3623 (void) sockaddr_un_unlink(&sa.un);
9c1e04d0 3624
9c1e04d0 3625 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
271f518f 3626 if (r < 0)
44ed5214 3627 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
9c1e04d0 3628
adc7d9f0 3629 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
271f518f 3630 if (r < 0)
adc7d9f0 3631 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
adc7d9f0 3632
2ff48e98 3633 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
271f518f 3634 if (r < 0)
2ff48e98 3635 return log_error_errno(r, "SO_PASSCRED failed: %m");
9c1e04d0 3636
271f518f 3637 return TAKE_FD(fd);
9c1e04d0
AP		 3638}
3639
03cfe0d5
LP		 3640static int outer_child(
3641 Barrier *barrier,
3642 const char *directory,
2d845785 3643 DissectedImage *dissected_image,
af06cd30 3644 int fd_outer_socket,
5d9d3fcb 3645 int fd_inner_socket,
d7bea6b6
DP		 3646 FDSet *fds,
3647 int netns_fd) {
03cfe0d5 3648
2f893044 3649 _cleanup_(bind_user_context_freep) BindUserContext *bind_user_context = NULL;
e1bb4b0d 3650 _cleanup_strv_free_ char **os_release_pairs = NULL;
254d1313 3651 _cleanup_close_ int fd = -EBADF, mntns_fd = -EBADF;
f61c7f88 3652 bool idmap = false;
e5f10caf 3653 const char *p;
03cfe0d5
LP		 3654 pid_t pid;
3655 ssize_t l;
de40a303 3656 int r;
03cfe0d5 3657
d1d0b895
LP		 3658 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It
3659 * already has its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in
3660 * the host's CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET
3661 * namespaces. After it completed a number of initializations a second child (the "inner" one) is
3662 * forked off it, and it exits. */
b37469d7 3663
03cfe0d5
LP		 3664 assert(barrier);
3665 assert(directory);
af06cd30 3666 assert(fd_outer_socket >= 0);
5d9d3fcb 3667 assert(fd_inner_socket >= 0);
03cfe0d5 3668
de40a303
LP		 3669 log_debug("Outer child is initializing.");
3670
e1bb4b0d
LB		 3671 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3672 if (r < 0)
3673 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3674
03cfe0d5
LP		 3675 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3676 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3677
03cfe0d5
LP		 3678 r = reset_audit_loginuid();
3679 if (r < 0)
3680 return r;
3681
2a2e78e9
LP		 3682 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3683 * mounts to the real root. */
511a8cfe 3684 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
60e76d48
ZJS		 3685 if (r < 0)
3686 return r;
03cfe0d5 3687
2d845785 3688 if (dissected_image) {
d1d0b895
LP		 3689 /* If we are operating on a disk image, then mount its root directory now, but leave out the
3690 * rest. We can read the UID shift from it if we need to. Further down we'll mount the rest,
3691 * but then with the uid shift known. That way we can mount VFAT file systems shifted to the
3692 * right place right away. This makes sure ESP partitions and userns are compatible. */
2d3a5a73 3693
af187ab2 3694 r = dissected_image_mount_and_warn(
d04faa4e
LP		 3695 dissected_image,
3696 directory,
3697 arg_uid_shift,
21b61b1d 3698 arg_uid_range,
d04faa4e
LP		 3699 DISSECT_IMAGE_MOUNT_ROOT_ONLY|
3700 DISSECT_IMAGE_DISCARD_ON_LOOP|
3701 DISSECT_IMAGE_USR_NO_ROOT|
c65f854a 3702 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
af187ab2 3703 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
2d845785 3704 if (r < 0)
af187ab2 3705 return r;
2d845785 3706 }
03cfe0d5 3707
391567f4
LP		 3708 r = determine_uid_shift(directory);
3709 if (r < 0)
3710 return r;
3711
0de7acce 3712 if (arg_userns_mode != USER_NAMESPACE_NO) {
b71a0192
CB		 3713 r = namespace_open(0, NULL, &mntns_fd, NULL, NULL, NULL);
3714 if (r < 0)
3715 return log_error_errno(r, "Failed to pin outer mount namespace: %m");
3716
af06cd30 3717 l = send_one_fd(fd_outer_socket, mntns_fd, 0);
b71a0192
CB		 3718 if (l < 0)
3719 return log_error_errno(l, "Failed to send outer mount namespace fd: %m");
3720 mntns_fd = safe_close(mntns_fd);
3721
0e7ac751 3722 /* Let the parent know which UID shift we read from the image */
af06cd30 3723 l = send(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
825d5287
RM		 3724 if (l < 0)
3725 return log_error_errno(errno, "Failed to send UID shift: %m");
baaa35ad
ZJS		 3726 if (l != sizeof(arg_uid_shift))
3727 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3728 "Short write while sending UID shift.");
0e7ac751 3729
0de7acce 3730 if (arg_userns_mode == USER_NAMESPACE_PICK) {
d1d0b895
LP		 3731 /* When we are supposed to pick the UID shift, the parent will check now whether the
3732 * UID shift we just read from the image is available. If yes, it will send the UID
3733 * shift back to us, if not it will pick a different one, and send it back to us. */
0e7ac751 3734
af06cd30 3735 l = recv(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
0e7ac751
LP		 3736 if (l < 0)
3737 return log_error_errno(errno, "Failed to recv UID shift: %m");
baaa35ad
ZJS		 3738 if (l != sizeof(arg_uid_shift))
3739 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3740 "Short read while receiving UID shift.");
0e7ac751
LP		 3741 }
3742
ff6c6cc1
LP		 3743 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3744 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
825d5287
RM		 3745 }
3746
6f83d3d1
LP		 3747 if (path_equal(directory, "/")) {
3748 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3749 * place, so that we can make changes to its mount structure (for example, to implement
3750 * --volatile=) without this interfering with our ability to access files such as
3751 * /etc/localtime to copy into the container. Note that we use a fixed place for this
6c2d70ce 3752 * (instead of a temporary directory, since we are living in our own mount namespace here
7802194a 3753 * already, and thus don't need to be afraid of colliding with anyone else's mounts). */
6f83d3d1
LP		 3754 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3755
511a8cfe 3756 r = mount_nofollow_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
6f83d3d1
LP		 3757 if (r < 0)
3758 return r;
3759
3760 directory = "/run/systemd/nspawn-root";
e50cd82f 3761 }
7d0ecdd6
LP		 3762
3763 r = setup_pivot_root(
3764 directory,
3765 arg_pivot_root_new,
3766 arg_pivot_root_old);
3767 if (r < 0)
3768 return r;
3769
3770 r = setup_volatile_mode(
3771 directory,
3772 arg_volatile_mode,
7d0ecdd6 3773 arg_uid_shift,
8f1ed04a 3774 arg_selinux_apifs_context);
7d0ecdd6
LP		 3775 if (r < 0)
3776 return r;
3777
2f893044
LP		 3778 r = bind_user_prepare(
3779 directory,
3780 arg_bind_user,
3781 arg_uid_shift,
3782 arg_uid_range,
3783 &arg_custom_mounts, &arg_n_custom_mounts,
3784 &bind_user_context);
3785 if (r < 0)
3786 return r;
3787
3788 if (arg_userns_mode != USER_NAMESPACE_NO && bind_user_context) {
d1d0b895
LP		 3789 /* Send the user maps we determined to the parent, so that it installs it in our user
3790 * namespace UID map table */
2f893044
LP		 3791
3792 for (size_t i = 0; i < bind_user_context->n_data; i++) {
3793 uid_t map[] = {
3794 bind_user_context->data[i].payload_user->uid,
3795 bind_user_context->data[i].host_user->uid,
3796 (uid_t) bind_user_context->data[i].payload_group->gid,
3797 (uid_t) bind_user_context->data[i].host_group->gid,
3798 };
3799
af06cd30 3800 l = send(fd_outer_socket, map, sizeof(map), MSG_NOSIGNAL);
2f893044
LP		 3801 if (l < 0)
3802 return log_error_errno(errno, "Failed to send user UID map: %m");
3803 if (l != sizeof(map))
3804 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3805 "Short write while sending user UID map.");
3806 }
3807 }
3808
5f0a6347
DDM		 3809 r = mount_custom(
3810 directory,
3811 arg_custom_mounts,
3812 arg_n_custom_mounts,
5f0a6347 3813 arg_uid_shift,
c0c8f718 3814 arg_uid_range,
5f0a6347
DDM		 3815 arg_selinux_apifs_context,
3816 MOUNT_ROOT_ONLY);
3817 if (r < 0)
3818 return r;
3819
5530dc87 3820 /* Make sure we always have a mount that we can move to root later on. */
14a25e1f
LP		 3821 r = make_mount_point(directory);
3822 if (r < 0)
3823 return r;
5530dc87 3824
c0c8f718
AV		 3825 if (arg_userns_mode != USER_NAMESPACE_NO &&
3826 IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
3827 arg_uid_shift != 0) {
3828
2b2777ed 3829 r = remount_idmap(directory, arg_uid_shift, arg_uid_range, UID_INVALID, REMOUNT_IDMAPPING_HOST_ROOT);
c0c8f718
AV		 3830 if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) {
3831 /* This might fail because the kernel or file system doesn't support idmapping. We
3832 * can't really distinguish this nicely, nor do we have any guarantees about the
3833 * error codes we see, could be EOPNOTSUPP or EINVAL. */
3834 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_AUTO)
3835 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3836 "ID mapped mounts are apparently not available, sorry.");
3837
3838 log_debug("ID mapped mounts are apparently not available on this kernel or for the selected file system, reverting to recursive chown()ing.");
3839 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3840 } else if (r < 0)
3841 return log_error_errno(r, "Failed to set up ID mapped mounts: %m");
3842 else {
3843 log_debug("ID mapped mounts available, making use of them.");
3844 idmap = true;
3845 }
3846 }
3847
2d3a5a73
LP		 3848 if (dissected_image) {
3849 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
d04faa4e
LP		 3850 r = dissected_image_mount(
3851 dissected_image,
3852 directory,
3853 arg_uid_shift,
21b61b1d 3854 arg_uid_range,
d04faa4e
LP		 3855 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|
3856 DISSECT_IMAGE_DISCARD_ON_LOOP|
3857 DISSECT_IMAGE_USR_NO_ROOT|
f61c7f88
LP		 3858 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3859 (idmap ? DISSECT_IMAGE_MOUNT_IDMAPPED : 0));
4fcb96ce
LP		 3860 if (r == -EUCLEAN)
3861 return log_error_errno(r, "File system check for image failed: %m");
2d3a5a73 3862 if (r < 0)
4fcb96ce 3863 return log_error_errno(r, "Failed to mount image file system: %m");
2d3a5a73
LP		 3864 }
3865
8199d554
LP		 3866 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3867 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3868
3869 r = detect_unified_cgroup_hierarchy_from_image(directory);
3870 if (r < 0)
3871 return r;
3872
fefb7a6d 3873 l = send(fd_outer_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
8199d554
LP		 3874 if (l < 0)
3875 return log_error_errno(errno, "Failed to send cgroup mode: %m");
baaa35ad
ZJS		 3876 if (l != sizeof(arg_unified_cgroup_hierarchy))
3877 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3878 "Short write while sending cgroup mode.");
8199d554
LP		 3879 }
3880
4ad14eff
LP		 3881 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3882 if (r < 0)
3883 return r;
3884
03cfe0d5
LP		 3885 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3886 if (r < 0)
3887 return r;
3888
bbd407ea
DDM		 3889 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3890 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
64e82c19 3891 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
03cfe0d5
LP		 3892 if (r < 0)
3893 return log_error_errno(r, "Failed to make tree read-only: %m");
3894 }
3895
0de7acce 3896 r = mount_all(directory,
4f086aab 3897 arg_mount_settings,
0de7acce 3898 arg_uid_shift,
0de7acce 3899 arg_selinux_apifs_context);
03cfe0d5
LP		 3900 if (r < 0)
3901 return r;
3902
07fa00f9
LP		 3903 r = copy_devnodes(directory);
3904 if (r < 0)
03cfe0d5
LP		 3905 return r;
3906
de40a303
LP		 3907 r = make_extra_nodes(directory);
3908 if (r < 0)
3909 return r;
3910
3911 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
e5f10caf 3912
9fac5029 3913 p = prefix_roota(directory, "/run/host");
e5f10caf 3914 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
03cfe0d5 3915
07fa00f9
LP		 3916 r = setup_pts(directory);
3917 if (r < 0)
03cfe0d5
LP		 3918 return r;
3919
e79581dd 3920 r = mount_tunnel_dig(directory);
03cfe0d5
LP		 3921 if (r < 0)
3922 return r;
3923
8e5430c4
LP		 3924 r = setup_keyring();
3925 if (r < 0)
3926 return r;
3927
3652872a
LP		 3928 r = setup_credentials(directory);
3929 if (r < 0)
3930 return r;
3931
2f893044
LP		 3932 r = bind_user_setup(bind_user_context, directory);
3933 if (r < 0)
3934 return r;
3935
5c4deb9a
MJ		 3936 r = mount_custom(
3937 directory,
3938 arg_custom_mounts,
3939 arg_n_custom_mounts,
3940 arg_uid_shift,
c0c8f718 3941 arg_uid_range,
5c4deb9a
MJ		 3942 arg_selinux_apifs_context,
3943 MOUNT_NON_ROOT_ONLY);
3944 if (r < 0)
3945 return r;
3946
03cfe0d5
LP		 3947 r = setup_timezone(directory);
3948 if (r < 0)
3949 return r;
3950
3951 r = setup_resolv_conf(directory);
3952 if (r < 0)
3953 return r;
3954
e01ff70a
MS		 3955 r = setup_machine_id(directory);
3956 if (r < 0)
3957 return r;
3958
03cfe0d5
LP		 3959 r = setup_journal(directory);
3960 if (r < 0)
3961 return r;
3962
0f48ba7b
LP		 3963 /* The same stuff as the $container env var, but nicely readable for the entire payload */
3964 p = prefix_roota(directory, "/run/host/container-manager");
3965 (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE);
3966
3967 /* The same stuff as the $container_uuid env var */
3968 p = prefix_roota(directory, "/run/host/container-uuid");
3969 (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
3970
489fae52 3971 if (!arg_use_cgns) {
0996ef00
CB		 3972 r = mount_cgroups(
3973 directory,
3974 arg_unified_cgroup_hierarchy,
3975 arg_userns_mode != USER_NAMESPACE_NO,
3976 arg_uid_shift,
3977 arg_uid_range,
5a8ff0e6 3978 arg_selinux_apifs_context,
ada54120 3979 false);
0996ef00
CB		 3980 if (r < 0)
3981 return r;
3982 }
03cfe0d5 3983
57c10a56
CB		 3984 /* Mark everything as shared so our mounts get propagated down. This is required to make new bind
3985 * mounts available in systemd services inside the container that create a new mount namespace. See
3986 * https://github.com/systemd/systemd/issues/3860 Further submounts (such as /dev) done after this
3987 * will inherit the shared propagation mode.
3988 *
3989 * IMPORTANT: Do not overmount the root directory anymore from now on to enable moving the root
3990 * directory mount to root later on.
3991 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3992 */
9d50f850 3993 r = mount_switch_root(directory, MS_SHARED);
03cfe0d5
LP		 3994 if (r < 0)
3995 return log_error_errno(r, "Failed to move root directory: %m");
3996
e79581dd
CB		 3997 /* We finished setting up the rootfs which is a shared mount. The mount tunnel needs to be a
3998 * dependent mount otherwise we can't MS_MOVE mounts that were propagated from the host into
3999 * the container. */
4000 r = mount_tunnel_open();
4001 if (r < 0)
4002 return r;
4003
b71a0192
CB		 4004 if (arg_userns_mode != USER_NAMESPACE_NO) {
4005 /* In order to mount procfs and sysfs in an unprivileged container the kernel
4006 * requires that a fully visible instance is already present in the target mount
4007 * namespace. Mount one here so the inner child can mount its own instances. Later
4008 * we umount the temporary instances created here before we actually exec the
4009 * payload. Since the rootfs is shared the umount will propagate into the container.
4010 * Note, the inner child wouldn't be able to unmount the instances on its own since
4011 * it doesn't own the originating mount namespace. IOW, the outer child needs to do
4012 * this. */
4013 r = pin_fully_visible_fs();
4014 if (r < 0)
4015 return r;
4016 }
4017
e96ceaba 4018 fd = setup_notify_child();
9c1e04d0
AP		 4019 if (fd < 0)
4020 return fd;
4021
03cfe0d5 4022 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
0c582db0 4023 arg_clone_ns_flags |
8869a0b4 4024 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
03cfe0d5
LP		 4025 if (pid < 0)
4026 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5 4027 if (pid == 0) {
af06cd30 4028 fd_outer_socket = safe_close(fd_outer_socket);
03cfe0d5 4029
2a2e78e9
LP		 4030 /* The inner child has all namespaces that are requested, so that we all are owned by the
4031 * user if user namespaces are turned on. */
03cfe0d5 4032
d7bea6b6
DP		 4033 if (arg_network_namespace_path) {
4034 r = namespace_enter(-1, -1, netns_fd, -1, -1);
4035 if (r < 0)
e2d39e54 4036 return log_error_errno(r, "Failed to join network namespace: %m");
d7bea6b6
DP		 4037 }
4038
4c27749b 4039 r = inner_child(barrier, directory, fd_inner_socket, fds, os_release_pairs);
03cfe0d5
LP		 4040 if (r < 0)
4041 _exit(EXIT_FAILURE);
4042
4043 _exit(EXIT_SUCCESS);
4044 }
4045
af06cd30 4046 l = send(fd_outer_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
03cfe0d5
LP		 4047 if (l < 0)
4048 return log_error_errno(errno, "Failed to send PID: %m");
baaa35ad
ZJS		 4049 if (l != sizeof(pid))
4050 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4051 "Short write while sending PID.");
03cfe0d5 4052
af06cd30 4053 l = send(fd_outer_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
e01ff70a
MS		 4054 if (l < 0)
4055 return log_error_errno(errno, "Failed to send machine ID: %m");
baaa35ad
ZJS		 4056 if (l != sizeof(arg_uuid))
4057 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4058 "Short write while sending machine ID.");
e01ff70a 4059
af06cd30 4060 l = send_one_fd(fd_outer_socket, fd, 0);
9c1e04d0 4061 if (l < 0)
ba72801d 4062 return log_error_errno(l, "Failed to send notify fd: %m");
9c1e04d0 4063
af06cd30 4064 fd_outer_socket = safe_close(fd_outer_socket);
5d9d3fcb 4065 fd_inner_socket = safe_close(fd_inner_socket);
d7bea6b6 4066 netns_fd = safe_close(netns_fd);
03cfe0d5
LP		 4067
4068 return 0;
4069}
4070
0e7ac751 4071static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
d381c8a6 4072 bool tried_hashed = false;
0e7ac751
LP		 4073 unsigned n_tries = 100;
4074 uid_t candidate;
4075 int r;
4076
4077 assert(shift);
4078 assert(ret_lock_file);
0de7acce 4079 assert(arg_userns_mode == USER_NAMESPACE_PICK);
0e7ac751
LP		 4080 assert(arg_uid_range == 0x10000U);
4081
4082 candidate = *shift;
4083
4084 (void) mkdir("/run/systemd/nspawn-uid", 0755);
4085
4086 for (;;) {
fbd0b64f 4087 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
8e766630 4088 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
0e7ac751
LP		 4089
4090 if (--n_tries <= 0)
4091 return -EBUSY;
4092
87d5e4f2 4093 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
0e7ac751
LP		 4094 goto next;
4095 if ((candidate & UINT32_C(0xFFFF)) != 0)
4096 goto next;
4097
4098 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
4099 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
4100 if (r == -EBUSY) /* Range already taken by another nspawn instance */
4101 goto next;
4102 if (r < 0)
4103 return r;
4104
4105 /* Make some superficial checks whether the range is currently known in the user database */
4106 if (getpwuid(candidate))
4107 goto next;
4108 if (getpwuid(candidate + UINT32_C(0xFFFE)))
4109 goto next;
4110 if (getgrgid(candidate))
4111 goto next;
4112 if (getgrgid(candidate + UINT32_C(0xFFFE)))
4113 goto next;
4114
4115 *ret_lock_file = lf;
4116 lf = (struct LockFile) LOCK_FILE_INIT;
4117 *shift = candidate;
4118 return 0;
4119
4120 next:
d381c8a6
LP		 4121 if (arg_machine && !tried_hashed) {
4122 /* Try to hash the base from the container name */
4123
4124 static const uint8_t hash_key[] = {
4125 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
4126 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
4127 };
4128
4129 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
4130
4131 tried_hashed = true;
4132 } else
4133 random_bytes(&candidate, sizeof(candidate));
4134
87d5e4f2 4135 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
0e7ac751
LP		 4136 candidate &= (uid_t) UINT32_C(0xFFFF0000);
4137 }
4138}
4139
2f893044
LP		 4140static int add_one_uid_map(
4141 char **p,
4142 uid_t container_uid,
4143 uid_t host_uid,
4144 uid_t range) {
4145
4146 return strextendf(p,
4147 UID_FMT " " UID_FMT " " UID_FMT "\n",
4148 container_uid, host_uid, range);
4149}
4150
4151static int make_uid_map_string(
4152 const uid_t bind_user_uid[],
4153 size_t n_bind_user_uid,
4154 size_t offset,
4155 char **ret) {
4156
4157 _cleanup_free_ char *s = NULL;
4158 uid_t previous_uid = 0;
4159 int r;
4160
4161 assert(n_bind_user_uid == 0 || bind_user_uid);
2f092762 4162 assert(IN_SET(offset, 0, 2)); /* used to switch between UID and GID map */
2f893044
LP		 4163 assert(ret);
4164
4165 /* The bind_user_uid[] array is a series of 4 uid_t values, for each --bind-user= entry one
4166 * quadruplet, consisting of host and container UID + GID. */
4167
4168 for (size_t i = 0; i < n_bind_user_uid; i++) {
05ab439a
YW		 4169 uid_t payload_uid = bind_user_uid[i*4+offset],
4170 host_uid = bind_user_uid[i*4+offset+1];
2f893044
LP		 4171
4172 assert(previous_uid <= payload_uid);
4173 assert(payload_uid < arg_uid_range);
4174
4175 /* Add a range to close the gap to previous entry */
4176 if (payload_uid > previous_uid) {
4177 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, payload_uid - previous_uid);
4178 if (r < 0)
4179 return r;
4180 }
4181
4182 /* Map this specific user */
4183 r = add_one_uid_map(&s, payload_uid, host_uid, 1);
4184 if (r < 0)
4185 return r;
4186
4187 previous_uid = payload_uid + 1;
4188 }
4189
4190 /* And add a range to close the gap to finish the range */
4191 if (arg_uid_range > previous_uid) {
4192 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, arg_uid_range - previous_uid);
4193 if (r < 0)
4194 return r;
4195 }
4196
4197 assert(s);
4198
4199 *ret = TAKE_PTR(s);
4200 return 0;
4201}
4202
4203static int setup_uid_map(
4204 pid_t pid,
4205 const uid_t bind_user_uid[],
4206 size_t n_bind_user_uid) {
4207
4208 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1];
4209 _cleanup_free_ char *s = NULL;
03cfe0d5
LP		 4210 int r;
4211
4212 assert(pid > 1);
4213
2f893044
LP		 4214 /* Build the UID map string */
4215 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 0, &s) < 0) /* offset=0 contains the UID pair */
4216 return log_oom();
4217
03cfe0d5 4218 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
2f893044 4219 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4220 if (r < 0)
4221 return log_error_errno(r, "Failed to write UID map: %m");
4222
2f893044
LP		 4223 /* And now build the GID map string */
4224 s = mfree(s);
4225 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 2, &s) < 0) /* offset=2 contains the GID pair */
4226 return log_oom();
4227
03cfe0d5 4228 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
2f893044 4229 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4230 if (r < 0)
4231 return log_error_errno(r, "Failed to write GID map: %m");
4232
4233 return 0;
4234}
4235
9c1e04d0 4236static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
9c1e04d0
AP		 4237 char buf[NOTIFY_BUFFER_MAX+1];
4238 char *p = NULL;
4239 struct iovec iovec = {
4240 .iov_base = buf,
4241 .iov_len = sizeof(buf)-1,
4242 };
fb29cdbe
LP		 4243 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
4244 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
9c1e04d0
AP		 4245 struct msghdr msghdr = {
4246 .msg_iov = &iovec,
4247 .msg_iovlen = 1,
4248 .msg_control = &control,
4249 .msg_controllen = sizeof(control),
4250 };
371d72e0 4251 struct ucred *ucred;
9c1e04d0
AP		 4252 ssize_t n;
4253 pid_t inner_child_pid;
4254 _cleanup_strv_free_ char **tags = NULL;
4bf4f50f 4255 int r;
9c1e04d0
AP		 4256
4257 assert(userdata);
4258
4259 inner_child_pid = PTR_TO_PID(userdata);
4260
4261 if (revents != EPOLLIN) {
4262 log_warning("Got unexpected poll event for notify fd.");
4263 return 0;
4264 }
4265
3691bcf3 4266 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
8add30a0
YW		 4267 if (n < 0) {
4268 if (ERRNO_IS_TRANSIENT(n))
4269 return 0;
4270 if (n == -EXFULL) {
4271 log_warning("Got message with truncated control data (too many fds sent?), ignoring.");
4272 return 0;
4273 }
3691bcf3 4274 return log_warning_errno(n, "Couldn't read notification socket: %m");
8add30a0 4275 }
9c1e04d0 4276
9c1e04d0
AP		 4277 cmsg_close_all(&msghdr);
4278
371d72e0 4279 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
9c1e04d0 4280 if (!ucred || ucred->pid != inner_child_pid) {
8cb57430 4281 log_debug("Received notify message without valid credentials. Ignoring.");
9c1e04d0
AP		 4282 return 0;
4283 }
4284
4285 if ((size_t) n >= sizeof(buf)) {
4286 log_warning("Received notify message exceeded maximum size. Ignoring.");
4287 return 0;
4288 }
4289
4290 buf[n] = 0;
4291 tags = strv_split(buf, "\n\r");
4292 if (!tags)
4293 return log_oom();
4294
d29cc4d6 4295 if (strv_contains(tags, "READY=1")) {
d4341b76 4296 r = sd_notify(false, "READY=1\n");
4bf4f50f
ZJS		 4297 if (r < 0)
4298 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
4299 }
9c1e04d0
AP		 4300
4301 p = strv_find_startswith(tags, "STATUS=");
4302 if (p)
04f590a4 4303 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
9c1e04d0
AP		 4304
4305 return 0;
4306}
4307
e96ceaba 4308static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
9c1e04d0 4309 int r;
9c1e04d0 4310
5773024d 4311 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
9c1e04d0
AP		 4312 if (r < 0)
4313 return log_error_errno(r, "Failed to allocate notify event source: %m");
4314
5773024d 4315 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
9c1e04d0
AP		 4316
4317 return 0;
4318}
4319
5d961407
LP		 4320static int merge_settings(Settings *settings, const char *path) {
4321 int rl;
f757855e 4322
5d961407
LP		 4323 assert(settings);
4324 assert(path);
f757855e 4325
5d961407
LP		 4326 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
4327 * that this steals the fields of the Settings* structure, and hence modifies it. */
f757855e 4328
7732f92b
LP		 4329 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
4330 settings->start_mode >= 0) {
4331 arg_start_mode = settings->start_mode;
130d3d22 4332 strv_free_and_replace(arg_parameters, settings->parameters);
f757855e
LP		 4333 }
4334
d3689b94
LP		 4335 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
4336 settings->ephemeral >= 0)
a2f577fc
JL		 4337 arg_ephemeral = settings->ephemeral;
4338
de40a303
LP		 4339 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
4340 settings->root) {
4341
4342 if (!arg_settings_trusted)
4343 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
4344 else
4345 free_and_replace(arg_directory, settings->root);
4346 }
4347
b53ede69
PW		 4348 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
4349 settings->pivot_root_new) {
4350 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
4351 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
4352 }
4353
5f932eb9 4354 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
1cc6c93a
YW		 4355 settings->working_directory)
4356 free_and_replace(arg_chdir, settings->working_directory);
5f932eb9 4357
f757855e 4358 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
130d3d22
YW		 4359 settings->environment)
4360 strv_free_and_replace(arg_setenv, settings->environment);
f757855e 4361
de40a303
LP		 4362 if ((arg_settings_mask & SETTING_USER) == 0) {
4363
4364 if (settings->user)
4365 free_and_replace(arg_user, settings->user);
4366
4367 if (uid_is_valid(settings->uid))
4368 arg_uid = settings->uid;
4369 if (gid_is_valid(settings->gid))
4370 arg_gid = settings->gid;
4371 if (settings->n_supplementary_gids > 0) {
4372 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
4373 arg_n_supplementary_gids = settings->n_supplementary_gids;
4374 }
4375 }
f757855e
LP		 4376
4377 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
a3fc6b55 4378 uint64_t plus, minus;
7be830c6 4379 uint64_t network_minus = 0;
88fc9c9b 4380 uint64_t ambient;
f757855e 4381
de40a303
LP		 4382 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
4383 * Settings structure */
4384
0e265674 4385 plus = settings->capability;
a3fc6b55
LP		 4386 minus = settings->drop_capability;
4387
9baa294c
LP		 4388 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4389 settings_network_configured(settings)) {
a3fc6b55
LP		 4390 if (settings_private_network(settings))
4391 plus |= UINT64_C(1) << CAP_NET_ADMIN;
4392 else
7be830c6 4393 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
a3fc6b55 4394 }
0e265674
LP		 4395
4396 if (!arg_settings_trusted && plus != 0) {
4397 if (settings->capability != 0)
5d961407 4398 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
7be830c6
TH		 4399 } else {
4400 arg_caps_retain &= ~network_minus;
520e0d54 4401 arg_caps_retain |= plus;
7be830c6 4402 }
f757855e 4403
a3fc6b55 4404 arg_caps_retain &= ~minus;
de40a303
LP		 4405
4406 /* Copy the full capabilities over too */
4407 if (capability_quintet_is_set(&settings->full_capabilities)) {
4408 if (!arg_settings_trusted)
5238e957 4409 log_warning("Ignoring capability settings, file %s is not trusted.", path);
de40a303
LP		 4410 else
4411 arg_full_capabilities = settings->full_capabilities;
4412 }
88fc9c9b
TH		 4413
4414 ambient = settings->ambient_capability;
4415 if (!arg_settings_trusted && ambient != 0)
4416 log_warning("Ignoring AmbientCapability= setting, file %s is not trusted.", path);
4417 else
4418 arg_caps_ambient |= ambient;
f757855e
LP		 4419 }
4420
4421 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
4422 settings->kill_signal > 0)
4423 arg_kill_signal = settings->kill_signal;
4424
4425 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
4426 settings->personality != PERSONALITY_INVALID)
4427 arg_personality = settings->personality;
4428
4429 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
4430 !sd_id128_is_null(settings->machine_id)) {
4431
4432 if (!arg_settings_trusted)
5d961407 4433 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
f757855e
LP		 4434 else
4435 arg_uuid = settings->machine_id;
4436 }
4437
4438 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
4439 settings->read_only >= 0)
4440 arg_read_only = settings->read_only;
4441
4442 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
4443 settings->volatile_mode != _VOLATILE_MODE_INVALID)
4444 arg_volatile_mode = settings->volatile_mode;
4445
4446 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
4447 settings->n_custom_mounts > 0) {
4448
4449 if (!arg_settings_trusted)
5d961407 4450 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
f757855e
LP		 4451 else {
4452 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
1cc6c93a 4453 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
f757855e 4454 arg_n_custom_mounts = settings->n_custom_mounts;
f757855e
LP		 4455 settings->n_custom_mounts = 0;
4456 }
4457 }
4458
4459 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
a1dfd585 4460 settings_network_configured(settings)) {
f757855e
LP		 4461
4462 if (!arg_settings_trusted)
5d961407 4463 log_warning("Ignoring network settings, file %s is not trusted.", path);
f757855e 4464 else {
f6d6bad1 4465 arg_network_veth = settings_network_veth(settings);
0e265674
LP		 4466 arg_private_network = settings_private_network(settings);
4467
130d3d22
YW		 4468 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
4469 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
4470 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
4471 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
f6d6bad1 4472
1cc6c93a
YW		 4473 free_and_replace(arg_network_bridge, settings->network_bridge);
4474 free_and_replace(arg_network_zone, settings->network_zone);
de40a303
LP		 4475
4476 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
f757855e
LP		 4477 }
4478 }
4479
4480 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
4481 settings->expose_ports) {
4482
4483 if (!arg_settings_trusted)
5d961407 4484 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
f757855e
LP		 4485 else {
4486 expose_port_free_all(arg_expose_ports);
1cc6c93a 4487 arg_expose_ports = TAKE_PTR(settings->expose_ports);
f757855e
LP		 4488 }
4489 }
4490
0de7acce
LP		 4491 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
4492 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
4493
4494 if (!arg_settings_trusted)
5d961407 4495 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
0de7acce
LP		 4496 else {
4497 arg_userns_mode = settings->userns_mode;
4498 arg_uid_shift = settings->uid_shift;
4499 arg_uid_range = settings->uid_range;
6c045a99 4500 arg_userns_ownership = settings->userns_ownership;
0de7acce
LP		 4501 }
4502 }
4503
0cc3c9f9
LP		 4504 if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
4505 !strv_isempty(settings->bind_user))
2f893044
LP		 4506 strv_free_and_replace(arg_bind_user, settings->bind_user);
4507
d3689b94
LP		 4508 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
4509 settings->notify_ready >= 0)
9c1e04d0
AP		 4510 arg_notify_ready = settings->notify_ready;
4511
960e4569
LP		 4512 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
4513
2d09ea44
LP		 4514 if (!strv_isempty(settings->syscall_allow_list) || !strv_isempty(settings->syscall_deny_list)) {
4515 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
4516 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
4517 else {
4518 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4519 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
4520 }
960e4569 4521 }
de40a303
LP		 4522
4523#if HAVE_SECCOMP
2d09ea44
LP		 4524 if (settings->seccomp) {
4525 if (!arg_settings_trusted)
4526 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4527 else {
4528 seccomp_release(arg_seccomp);
4529 arg_seccomp = TAKE_PTR(settings->seccomp);
4530 }
de40a303
LP		 4531 }
4532#endif
960e4569
LP		 4533 }
4534
bf428efb
LP		 4535 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4536 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4537 continue;
4538
4539 if (!settings->rlimit[rl])
4540 continue;
4541
4542 if (!arg_settings_trusted) {
5d961407 4543 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
bf428efb
LP		 4544 continue;
4545 }
4546
4547 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4548 }
4549
3a9530e5
LP		 4550 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4551 settings->hostname)
4552 free_and_replace(arg_hostname, settings->hostname);
4553
66edd963
LP		 4554 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4555 settings->no_new_privileges >= 0)
4556 arg_no_new_privileges = settings->no_new_privileges;
4557
81f345df
LP		 4558 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4559 settings->oom_score_adjust_set) {
4560
4561 if (!arg_settings_trusted)
5d961407 4562 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
81f345df
LP		 4563 else {
4564 arg_oom_score_adjust = settings->oom_score_adjust;
4565 arg_oom_score_adjust_set = true;
4566 }
4567 }
4568
d107bb7d 4569 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
0985c7c4 4570 settings->cpu_set.set) {
d107bb7d
LP		 4571
4572 if (!arg_settings_trusted)
5d961407 4573 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
d107bb7d 4574 else {
0985c7c4
ZJS		 4575 cpu_set_reset(&arg_cpu_set);
4576 arg_cpu_set = settings->cpu_set;
4577 settings->cpu_set = (CPUSet) {};
d107bb7d
LP		 4578 }
4579 }
4580
09d423e9
LP		 4581 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4582 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4583 arg_resolv_conf = settings->resolv_conf;
4584
4e1d6aa9
LP		 4585 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4586 settings->link_journal != _LINK_JOURNAL_INVALID) {
4587
4588 if (!arg_settings_trusted)
4589 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4590 else {
4591 arg_link_journal = settings->link_journal;
4592 arg_link_journal_try = settings->link_journal_try;
4593 }
4594 }
4595
1688841f
LP		 4596 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4597 settings->timezone != _TIMEZONE_MODE_INVALID)
4598 arg_timezone = settings->timezone;
4599
de40a303
LP		 4600 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4601 settings->slice) {
4602
4603 if (!arg_settings_trusted)
4604 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4605 else
4606 free_and_replace(arg_slice, settings->slice);
4607 }
4608
4609 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4610 settings->use_cgns >= 0) {
4611
4612 if (!arg_settings_trusted)
4613 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4614 else
4615 arg_use_cgns = settings->use_cgns;
4616 }
4617
4618 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
f5fbe71d 4619 settings->clone_ns_flags != ULONG_MAX) {
de40a303
LP		 4620
4621 if (!arg_settings_trusted)
4622 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4623 else
4624 arg_clone_ns_flags = settings->clone_ns_flags;
4625 }
4626
4627 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4628 settings->console_mode >= 0) {
4629
4630 if (!arg_settings_trusted)
4631 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4632 else
4633 arg_console_mode = settings->console_mode;
4634 }
4635
d3689b94
LP		 4636 if ((arg_settings_mask & SETTING_SUPPRESS_SYNC) == 0 &&
4637 settings->suppress_sync >= 0)
4a4654e0
LP		 4638 arg_suppress_sync = settings->suppress_sync;
4639
de40a303
LP		 4640 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4641 * don't consult arg_settings_mask for them. */
4642
4643 sd_bus_message_unref(arg_property_message);
4644 arg_property_message = TAKE_PTR(settings->properties);
4645
4646 arg_console_width = settings->console_width;
4647 arg_console_height = settings->console_height;
4648
b2645747 4649 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
de40a303
LP		 4650 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4651 arg_n_extra_nodes = settings->n_extra_nodes;
4652
f757855e
LP		 4653 return 0;
4654}
4655
5d961407
LP		 4656static int load_settings(void) {
4657 _cleanup_(settings_freep) Settings *settings = NULL;
4658 _cleanup_fclose_ FILE *f = NULL;
3603f151 4659 _cleanup_free_ char *p = NULL;
5d961407
LP		 4660 int r;
4661
de40a303
LP		 4662 if (arg_oci_bundle)
4663 return 0;
4664
5d961407
LP		 4665 /* If all settings are masked, there's no point in looking for
4666 * the settings file */
d7a0f1f4 4667 if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
5d961407
LP		 4668 return 0;
4669
5d961407
LP		 4670 /* We first look in the admin's directories in /etc and /run */
4671 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4672 _cleanup_free_ char *j = NULL;
4673
3603f151 4674 j = path_join(i, arg_settings_filename);
5d961407
LP		 4675 if (!j)
4676 return log_oom();
4677
4678 f = fopen(j, "re");
4679 if (f) {
4680 p = TAKE_PTR(j);
4681
4682 /* By default, we trust configuration from /etc and /run */
4683 if (arg_settings_trusted < 0)
4684 arg_settings_trusted = true;
4685
4686 break;
4687 }
4688
4689 if (errno != ENOENT)
4690 return log_error_errno(errno, "Failed to open %s: %m", j);
4691 }
4692
4693 if (!f) {
4694 /* After that, let's look for a file next to the
4695 * actual image we shall boot. */
4696
4697 if (arg_image) {
162f6477
LP		 4698 r = file_in_same_dir(arg_image, arg_settings_filename, &p);
4699 if (r < 0)
4700 return log_error_errno(r, "Failed to generate settings path from image path: %m");
4701 } else if (arg_directory) {
4702 r = file_in_same_dir(arg_directory, arg_settings_filename, &p);
4703 if (r < 0 && r != -EADDRNOTAVAIL) /* if directory is root fs, don't complain */
4704 return log_error_errno(r, "Failed to generate settings path from directory path: %m");
5d961407
LP		 4705 }
4706
4707 if (p) {
4708 f = fopen(p, "re");
4709 if (!f && errno != ENOENT)
4710 return log_error_errno(errno, "Failed to open %s: %m", p);
4711
4712 /* By default, we do not trust configuration from /var/lib/machines */
4713 if (arg_settings_trusted < 0)
4714 arg_settings_trusted = false;
4715 }
4716 }
4717
4718 if (!f)
4719 return 0;
4720
4721 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4722
4723 r = settings_load(f, p, &settings);
4724 if (r < 0)
4725 return r;
4726
4727 return merge_settings(settings, p);
4728}
4729
de40a303
LP		 4730static int load_oci_bundle(void) {
4731 _cleanup_(settings_freep) Settings *settings = NULL;
4732 int r;
4733
4734 if (!arg_oci_bundle)
4735 return 0;
4736
4737 /* By default let's trust OCI bundles */
4738 if (arg_settings_trusted < 0)
4739 arg_settings_trusted = true;
4740
4741 r = oci_load(NULL, arg_oci_bundle, &settings);
4742 if (r < 0)
4743 return r;
4744
4745 return merge_settings(settings, arg_oci_bundle);
4746}
4747
3acc84eb 4748static int run_container(
2d845785 4749 DissectedImage *dissected_image,
b0067625
ZJS		 4750 FDSet *fds,
4751 char veth_name[IFNAMSIZ], bool *veth_created,
761cf19d 4752 struct ExposeArgs *expose_args,
3acc84eb 4753 int *master, pid_t *pid, int *ret) {
b0067625
ZJS		 4754
4755 static const struct sigaction sa = {
4756 .sa_handler = nop_signal_handler,
e28c7cd0 4757 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
b0067625
ZJS		 4758 };
4759
8e766630 4760 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
5bb1d7fb 4761 _cleanup_close_ int etc_passwd_lock = -EBADF;
b0067625 4762 _cleanup_close_pair_ int
19ee48a6
YW		 4763 fd_inner_socket_pair[2] = PIPE_EBADF,
4764 fd_outer_socket_pair[2] = PIPE_EBADF;
8199d554 4765
5bb1d7fb 4766 _cleanup_close_ int notify_socket = -EBADF, mntns_fd = -EBADF, fd_kmsg_fifo = -EBADF;
b0067625 4767 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
5773024d 4768 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
b0067625
ZJS		 4769 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4770 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4771 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
abdb9b08 4772 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2f893044
LP		 4773 _cleanup_free_ uid_t *bind_user_uid = NULL;
4774 size_t n_bind_user_uid = 0;
b0067625 4775 ContainerStatus container_status = 0;
b0067625
ZJS		 4776 int ifi = 0, r;
4777 ssize_t l;
4778 sigset_t mask_chld;
254d1313 4779 _cleanup_close_ int child_netns_fd = -EBADF;
b0067625
ZJS		 4780
4781 assert_se(sigemptyset(&mask_chld) == 0);
4782 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4783
4784 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4785 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4786 * check with getpwuid() if the specific user already exists. Note that /etc might be
4787 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4788 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4789 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4790 * really ours. */
4791
4792 etc_passwd_lock = take_etc_passwd_lock(NULL);
4793 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4794 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4795 }
4796
4797 r = barrier_create(&barrier);
4798 if (r < 0)
4799 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4800
5d9d3fcb
CB		 4801 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_inner_socket_pair) < 0)
4802 return log_error_errno(errno, "Failed to create inner socket pair: %m");
4803
af06cd30
CB		 4804 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_outer_socket_pair) < 0)
4805 return log_error_errno(errno, "Failed to create outer socket pair: %m");
b0067625 4806
b0067625
ZJS		 4807 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4808 * parent's blocking calls and give it a chance to call wait() and terminate. */
4809 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4810 if (r < 0)
4811 return log_error_errno(errno, "Failed to change the signal mask: %m");
4812
4813 r = sigaction(SIGCHLD, &sa, NULL);
4814 if (r < 0)
4815 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4816
d7bea6b6 4817 if (arg_network_namespace_path) {
5b4855ab
DDM		 4818 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4819 if (child_netns_fd < 0)
d7bea6b6
DP		 4820 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4821
54c2459d 4822 r = fd_is_ns(child_netns_fd, CLONE_NEWNET);
6619ad88
LP		 4823 if (r == -EUCLEAN)
4824 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4825 else if (r < 0)
d7bea6b6 4826 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
c6147113
LP		 4827 else if (r == 0)
4828 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4829 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
d7bea6b6
DP		 4830 }
4831
b0067625
ZJS		 4832 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4833 if (*pid < 0)
4834 return log_error_errno(errno, "clone() failed%s: %m",
4835 errno == EINVAL ?
4836 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4837
4838 if (*pid == 0) {
4839 /* The outer child only has a file system namespace. */
4840 barrier_set_role(&barrier, BARRIER_CHILD);
4841
5d9d3fcb 4842 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
af06cd30 4843 fd_outer_socket_pair[0] = safe_close(fd_outer_socket_pair[0]);
b0067625
ZJS		 4844
4845 (void) reset_all_signal_handlers();
4846 (void) reset_signal_mask();
4847
4848 r = outer_child(&barrier,
4849 arg_directory,
2d845785 4850 dissected_image,
af06cd30 4851 fd_outer_socket_pair[1],
5d9d3fcb 4852 fd_inner_socket_pair[1],
d7bea6b6 4853 fds,
5b4855ab 4854 child_netns_fd);
b0067625
ZJS		 4855 if (r < 0)
4856 _exit(EXIT_FAILURE);
4857
4858 _exit(EXIT_SUCCESS);
4859 }
4860
4861 barrier_set_role(&barrier, BARRIER_PARENT);
4862
e4077ff6 4863 fdset_close(fds);
b0067625 4864
5d9d3fcb 4865 fd_inner_socket_pair[1] = safe_close(fd_inner_socket_pair[1]);
af06cd30 4866 fd_outer_socket_pair[1] = safe_close(fd_outer_socket_pair[1]);
b0067625
ZJS		 4867
4868 if (arg_userns_mode != USER_NAMESPACE_NO) {
af06cd30 4869 mntns_fd = receive_one_fd(fd_outer_socket_pair[0], 0);
b71a0192
CB		 4870 if (mntns_fd < 0)
4871 return log_error_errno(mntns_fd, "Failed to receive mount namespace fd from outer child: %m");
4872
b0067625 4873 /* The child just let us know the UID shift it might have read from the image. */
af06cd30 4874 l = recv(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
b0067625
ZJS		 4875 if (l < 0)
4876 return log_error_errno(errno, "Failed to read UID shift: %m");
c6147113
LP		 4877 if (l != sizeof arg_uid_shift)
4878 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
b0067625
ZJS		 4879
4880 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4881 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4882 * image, but if that's already in use, pick a new one, and report back to the child,
4883 * which one we now picked. */
4884
4885 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4886 if (r < 0)
4887 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4888
af06cd30 4889 l = send(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
b0067625
ZJS		 4890 if (l < 0)
4891 return log_error_errno(errno, "Failed to send UID shift: %m");
c6147113
LP		 4892 if (l != sizeof arg_uid_shift)
4893 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
b0067625 4894 }
2f893044
LP		 4895
4896 n_bind_user_uid = strv_length(arg_bind_user);
4897 if (n_bind_user_uid > 0) {
4898 /* Right after the UID shift, we'll receive the list of UID mappings for the
4899 * --bind-user= logic. Always a quadruplet of payload and host UID + GID. */
4900
4901 bind_user_uid = new(uid_t, n_bind_user_uid*4);
4902 if (!bind_user_uid)
4903 return log_oom();
4904
4905 for (size_t i = 0; i < n_bind_user_uid; i++) {
af06cd30 4906 l = recv(fd_outer_socket_pair[0], bind_user_uid + i*4, sizeof(uid_t)*4, 0);
2f893044
LP		 4907 if (l < 0)
4908 return log_error_errno(errno, "Failed to read user UID map pair: %m");
4909 if (l != sizeof(uid_t)*4)
4910 return log_full_errno(l == 0 ? LOG_DEBUG : LOG_WARNING,
4911 SYNTHETIC_ERRNO(EIO),
4912 "Short read while reading bind user UID pairs.");
4913 }
4914 }
b0067625
ZJS		 4915 }
4916
8199d554
LP		 4917 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4918 /* The child let us know the support cgroup mode it might have read from the image. */
fefb7a6d 4919 l = recv(fd_outer_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
8199d554
LP		 4920 if (l < 0)
4921 return log_error_errno(errno, "Failed to read cgroup mode: %m");
c6147113 4922 if (l != sizeof(arg_unified_cgroup_hierarchy))
c0f86d66 4923 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
c6147113 4924 l, l == 0 ? " The child is most likely dead." : "");
8199d554
LP		 4925 }
4926
b0067625 4927 /* Wait for the outer child. */
d2e0ac3d
LP		 4928 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4929 if (r < 0)
4930 return r;
4931 if (r != EXIT_SUCCESS)
4932 return -EIO;
b0067625
ZJS		 4933
4934 /* And now retrieve the PID of the inner child. */
af06cd30 4935 l = recv(fd_outer_socket_pair[0], pid, sizeof *pid, 0);
b0067625
ZJS		 4936 if (l < 0)
4937 return log_error_errno(errno, "Failed to read inner child PID: %m");
c6147113
LP		 4938 if (l != sizeof *pid)
4939 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
b0067625
ZJS		 4940
4941 /* We also retrieve container UUID in case it was generated by outer child */
af06cd30 4942 l = recv(fd_outer_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
b0067625
ZJS		 4943 if (l < 0)
4944 return log_error_errno(errno, "Failed to read container machine ID: %m");
c6147113
LP		 4945 if (l != sizeof(arg_uuid))
4946 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
b0067625
ZJS		 4947
4948 /* We also retrieve the socket used for notifications generated by outer child */
af06cd30 4949 notify_socket = receive_one_fd(fd_outer_socket_pair[0], 0);
b0067625
ZJS		 4950 if (notify_socket < 0)
4951 return log_error_errno(notify_socket,
4952 "Failed to receive notification socket from the outer child: %m");
4953
4954 log_debug("Init process invoked as PID "PID_FMT, *pid);
4955
4956 if (arg_userns_mode != USER_NAMESPACE_NO) {
c6147113
LP		 4957 if (!barrier_place_and_sync(&barrier)) /* #1 */
4958 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 4959
2f893044 4960 r = setup_uid_map(*pid, bind_user_uid, n_bind_user_uid);
b0067625
ZJS		 4961 if (r < 0)
4962 return r;
4963
4964 (void) barrier_place(&barrier); /* #2 */
4965 }
4966
4967 if (arg_private_network) {
75116558
PS		 4968 if (!arg_network_namespace_path) {
4969 /* Wait until the child has unshared its network namespace. */
c6147113
LP		 4970 if (!barrier_place_and_sync(&barrier)) /* #3 */
4971 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
75116558
PS		 4972 }
4973
5b4855ab
DDM		 4974 if (child_netns_fd < 0) {
4975 /* Make sure we have an open file descriptor to the child's network
4976 * namespace so it stays alive even if the child exits. */
4977 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
4978 if (r < 0)
4979 return log_error_errno(r, "Failed to open child network namespace: %m");
4980 }
4981
4982 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
b0067625
ZJS		 4983 if (r < 0)
4984 return r;
4985
4986 if (arg_network_veth) {
4987 r = setup_veth(arg_machine, *pid, veth_name,
4988 arg_network_bridge || arg_network_zone);
4989 if (r < 0)
4990 return r;
4991 else if (r > 0)
4992 ifi = r;
4993
4994 if (arg_network_bridge) {
4995 /* Add the interface to a bridge */
4996 r = setup_bridge(veth_name, arg_network_bridge, false);
4997 if (r < 0)
4998 return r;
4999 if (r > 0)
5000 ifi = r;
5001 } else if (arg_network_zone) {
5002 /* Add the interface to a bridge, possibly creating it */
5003 r = setup_bridge(veth_name, arg_network_zone, true);
5004 if (r < 0)
5005 return r;
5006 if (r > 0)
5007 ifi = r;
5008 }
5009 }
5010
5011 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
5012 if (r < 0)
5013 return r;
5014
5015 /* We created the primary and extra veth links now; let's remember this, so that we know to
5016 remove them later on. Note that we don't bother with removing veth links that were created
5017 here when their setup failed half-way, because in that case the kernel should be able to
5018 remove them on its own, since they cannot be referenced by anything yet. */
5019 *veth_created = true;
5020
5021 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
5022 if (r < 0)
5023 return r;
5024
5025 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
5026 if (r < 0)
5027 return r;
5028 }
5029
abdb9b08
LP		 5030 if (arg_register || !arg_keep_unit) {
5031 r = sd_bus_default_system(&bus);
5032 if (r < 0)
5033 return log_error_errno(r, "Failed to open system bus: %m");
e5a2d8b5
LP		 5034
5035 r = sd_bus_set_close_on_exit(bus, false);
5036 if (r < 0)
5037 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
abdb9b08
LP		 5038 }
5039
5040 if (!arg_keep_unit) {
5041 /* When a new scope is created for this container, then we'll be registered as its controller, in which
5042 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
5043 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
5044
75152a4d
LP		 5045 r = sd_bus_match_signal_async(
5046 bus,
5047 NULL,
5048 "org.freedesktop.systemd1",
5049 NULL,
5050 "org.freedesktop.systemd1.Scope",
5051 "RequestStop",
5052 on_request_stop, NULL, PID_TO_PTR(*pid));
abdb9b08 5053 if (r < 0)
75152a4d 5054 return log_error_errno(r, "Failed to request RequestStop match: %m");
abdb9b08
LP		 5055 }
5056
b0067625
ZJS		 5057 if (arg_register) {
5058 r = register_machine(
abdb9b08 5059 bus,
b0067625
ZJS		 5060 arg_machine,
5061 *pid,
5062 arg_directory,
5063 arg_uuid,
5064 ifi,
5065 arg_slice,
5066 arg_custom_mounts, arg_n_custom_mounts,
5067 arg_kill_signal,
5068 arg_property,
de40a303 5069 arg_property_message,
b0067625
ZJS		 5070 arg_keep_unit,
5071 arg_container_service_name);
5072 if (r < 0)
5073 return r;
abdb9b08 5074
cd2dfc6f
LP		 5075 } else if (!arg_keep_unit) {
5076 r = allocate_scope(
abdb9b08 5077 bus,
cd2dfc6f
LP		 5078 arg_machine,
5079 *pid,
5080 arg_slice,
5081 arg_custom_mounts, arg_n_custom_mounts,
5082 arg_kill_signal,
de40a303
LP		 5083 arg_property,
5084 arg_property_message);
cd2dfc6f
LP		 5085 if (r < 0)
5086 return r;
5087
5088 } else if (arg_slice || arg_property)
5089 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
b0067625 5090
27da7ef0 5091 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
b0067625
ZJS		 5092 if (r < 0)
5093 return r;
5094
27da7ef0 5095 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
720f0a2f
LP		 5096 if (r < 0)
5097 return r;
b0067625 5098
de54e02d 5099 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
b0067625
ZJS		 5100 if (r < 0)
5101 return r;
5102
5103 /* Notify the child that the parent is ready with all
5104 * its setup (including cgroup-ification), and that
5105 * the child can now hand over control to the code to
5106 * run inside the container. */
75116558 5107 (void) barrier_place(&barrier); /* #4 */
b0067625
ZJS		 5108
5109 /* Block SIGCHLD here, before notifying child.
5110 * process_pty() will handle it with the other signals. */
5111 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
5112
5113 /* Reset signal to default */
9c274488 5114 r = default_signals(SIGCHLD);
b0067625
ZJS		 5115 if (r < 0)
5116 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
5117
5118 r = sd_event_new(&event);
5119 if (r < 0)
5120 return log_error_errno(r, "Failed to get default event source: %m");
5121
8fd010bb
LP		 5122 (void) sd_event_set_watchdog(event, true);
5123
abdb9b08
LP		 5124 if (bus) {
5125 r = sd_bus_attach_event(bus, event, 0);
5126 if (r < 0)
5127 return log_error_errno(r, "Failed to attach bus to event loop: %m");
5128 }
5129
e96ceaba 5130 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
b0067625
ZJS		 5131 if (r < 0)
5132 return r;
5133
b71a0192
CB		 5134 if (arg_userns_mode != USER_NAMESPACE_NO) {
5135 r = wipe_fully_visible_fs(mntns_fd);
5136 if (r < 0)
5137 return r;
5138 mntns_fd = safe_close(mntns_fd);
5139 }
5140
b0067625 5141 /* Let the child know that we are ready and wait that the child is completely ready now. */
c6147113
LP		 5142 if (!barrier_place_and_sync(&barrier)) /* #5 */
5143 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 5144
38ccb557 5145 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
b0067625
ZJS		 5146 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
5147 etc_passwd_lock = safe_close(etc_passwd_lock);
5148
04f590a4
LP		 5149 (void) sd_notifyf(false,
5150 "STATUS=Container running.\n"
5151 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
4bf4f50f
ZJS		 5152 if (!arg_notify_ready) {
5153 r = sd_notify(false, "READY=1\n");
5154 if (r < 0)
5155 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
5156 }
b0067625
ZJS		 5157
5158 if (arg_kill_signal > 0) {
5159 /* Try to kill the init system on SIGINT or SIGTERM */
919f5ae0
LP		 5160 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
5161 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
b0067625
ZJS		 5162 } else {
5163 /* Immediately exit */
919f5ae0
LP		 5164 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
5165 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
b0067625
ZJS		 5166 }
5167
988851b6
LP		 5168 (void) sd_event_add_signal(event, NULL, SIGRTMIN+18, sigrtmin18_handler, NULL);
5169
5170 r = sd_event_add_memory_pressure(event, NULL, NULL, NULL);
5171 if (r < 0)
5172 log_debug_errno(r, "Failed allocate memory pressure event source, ignoring: %m");
5173
6916b164 5174 /* Exit when the child exits */
919f5ae0 5175 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
b0067625 5176
b07ee903
CB		 5177 /* Retrieve the kmsg fifo allocated by inner child */
5178 fd_kmsg_fifo = receive_one_fd(fd_inner_socket_pair[0], 0);
5179 if (fd_kmsg_fifo < 0)
5180 return log_error_errno(fd_kmsg_fifo, "Failed to receive kmsg fifo from inner child: %m");
5181
b0067625 5182 if (arg_expose_ports) {
b07ee903 5183 r = expose_port_watch_rtnl(event, fd_inner_socket_pair[0], on_address_change, expose_args, &rtnl);
b0067625
ZJS		 5184 if (r < 0)
5185 return r;
5186
deff68e7
FW		 5187 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5188 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5189 }
5190
3acc84eb 5191 if (arg_console_mode != CONSOLE_PIPE) {
254d1313 5192 _cleanup_close_ int fd = -EBADF;
3acc84eb 5193 PTYForwardFlags flags = 0;
de40a303 5194
3acc84eb 5195 /* Retrieve the master pty allocated by inner child */
bb1aa185 5196 fd = receive_one_fd(fd_inner_socket_pair[0], 0);
3acc84eb
FB		 5197 if (fd < 0)
5198 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
5199
5200 switch (arg_console_mode) {
de40a303 5201
3acc84eb
FB		 5202 case CONSOLE_READ_ONLY:
5203 flags |= PTY_FORWARD_READ_ONLY;
5204
5205 _fallthrough_;
5206
5207 case CONSOLE_INTERACTIVE:
5208 flags |= PTY_FORWARD_IGNORE_VHANGUP;
5209
5210 r = pty_forward_new(event, fd, flags, &forward);
5211 if (r < 0)
5212 return log_error_errno(r, "Failed to create PTY forwarder: %m");
5213
f5fbe71d 5214 if (arg_console_width != UINT_MAX || arg_console_height != UINT_MAX)
3acc84eb
FB		 5215 (void) pty_forward_set_width_height(forward,
5216 arg_console_width,
5217 arg_console_height);
5218 break;
5219
5220 default:
5221 assert(arg_console_mode == CONSOLE_PASSIVE);
5222 }
5223
5224 *master = TAKE_FD(fd);
de40a303 5225 }
b0067625 5226
5d9d3fcb
CB		 5227 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
5228
b0067625
ZJS		 5229 r = sd_event_loop(event);
5230 if (r < 0)
5231 return log_error_errno(r, "Failed to run event loop: %m");
5232
de40a303
LP		 5233 if (forward) {
5234 char last_char = 0;
b0067625 5235
de40a303
LP		 5236 (void) pty_forward_get_last_char(forward, &last_char);
5237 forward = pty_forward_free(forward);
b0067625 5238
de40a303
LP		 5239 if (!arg_quiet && last_char != '\n')
5240 putc('\n', stdout);
5241 }
b0067625
ZJS		 5242
5243 /* Kill if it is not dead yet anyway */
0bb0a9fa
ZJS		 5244 if (!arg_register && !arg_keep_unit && bus)
5245 terminate_scope(bus, arg_machine);
b0067625
ZJS		 5246
5247 /* Normally redundant, but better safe than sorry */
c67b0082 5248 (void) kill(*pid, SIGKILL);
b0067625 5249
5d9d3fcb
CB		 5250 fd_kmsg_fifo = safe_close(fd_kmsg_fifo);
5251
5b4855ab
DDM		 5252 if (arg_private_network) {
5253 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
5254 * to avoid having to move the parent to the child network namespace. */
5255 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
5256 if (r < 0)
5257 return r;
5258
5259 if (r == 0) {
254d1313 5260 _cleanup_close_ int parent_netns_fd = -EBADF;
5b4855ab
DDM		 5261
5262 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
5263 if (r < 0) {
5264 log_error_errno(r, "Failed to open parent network namespace: %m");
5265 _exit(EXIT_FAILURE);
5266 }
5267
5268 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
5269 if (r < 0) {
5270 log_error_errno(r, "Failed to enter child network namespace: %m");
5271 _exit(EXIT_FAILURE);
5272 }
5273
5274 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
5275 if (r < 0)
5276 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
5277
5278 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
5279 }
5280 }
5281
8f03de53 5282 r = wait_for_container(TAKE_PID(*pid), &container_status);
b0067625 5283
0bb0a9fa
ZJS		 5284 /* Tell machined that we are gone. */
5285 if (bus)
5286 (void) unregister_machine(bus, arg_machine);
5287
b0067625
ZJS		 5288 if (r < 0)
5289 /* We failed to wait for the container, or the container exited abnormally. */
5290 return r;
5291 if (r > 0 || container_status == CONTAINER_TERMINATED) {
27e29a1e
ZJS		 5292 /* r > 0 → The container exited with a non-zero status.
5293 * As a special case, we need to replace 133 with a different value,
5294 * because 133 is special-cased in the service file to reboot the container.
5295 * otherwise → The container exited with zero status and a reboot was not requested.
5296 */
2a49b612 5297 if (r == EXIT_FORCE_RESTART)
27e29a1e 5298 r = EXIT_FAILURE; /* replace 133 with the general failure code */
b0067625 5299 *ret = r;
b0067625
ZJS		 5300 return 0; /* finito */
5301 }
5302
5303 /* CONTAINER_REBOOTED, loop again */
5304
5305 if (arg_keep_unit) {
5306 /* Special handling if we are running as a service: instead of simply
5307 * restarting the machine we want to restart the entire service, so let's
5308 * inform systemd about this with the special exit code 133. The service
5309 * file uses RestartForceExitStatus=133 so that this results in a full
5310 * nspawn restart. This is necessary since we might have cgroup parameters
5311 * set we want to have flushed out. */
2a49b612
ZJS		 5312 *ret = EXIT_FORCE_RESTART;
5313 return 0; /* finito */
b0067625
ZJS		 5314 }
5315
deff68e7
FW		 5316 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5317 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5318
5319 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5320 *veth_created = false;
5321 return 1; /* loop again */
5322}
5323
bf428efb 5324static int initialize_rlimits(void) {
852b6250 5325 /* The default resource limits the kernel passes to PID 1, as per kernel 5.16. Let's pass our container payload
bf428efb
LP		 5326 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
5327 * container execution environments. */
5328
5329 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
852b6250
LP		 5330 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
5331 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
5332 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
5333 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
5334 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
5335 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
5336 [RLIMIT_MEMLOCK] = { DEFAULT_RLIMIT_MEMLOCK, DEFAULT_RLIMIT_MEMLOCK },
5337 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
5338 [RLIMIT_NICE] = { 0, 0 },
5339 [RLIMIT_NOFILE] = { 1024, 4096 },
5340 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
5341 [RLIMIT_RTPRIO] = { 0, 0 },
5342 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
5343 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
bf428efb
LP		 5344
5345 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
5346 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
5347 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
5348 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
5349 * that PID 1 changes a number of other resource limits during early initialization which is why we
5350 * don't read the other limits from PID 1 but prefer the static table above. */
5351 };
5352
5353 int rl;
5354
5355 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
bf428efb
LP		 5356 /* Let's only fill in what the user hasn't explicitly configured anyway */
5357 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
5358 const struct rlimit *v;
5359 struct rlimit buffer;
5360
5361 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
5362 /* For these two let's read the limits off PID 1. See above for an explanation. */
5363
5364 if (prlimit(1, rl, NULL, &buffer) < 0)
5365 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
5366
dbf1aca6
LP		 5367 v = &buffer;
5368 } else if (rl == RLIMIT_NOFILE) {
5369 /* We nowadays bump RLIMIT_NOFILE's hard limit early in PID 1 for all
5370 * userspace. Given that nspawn containers are often run without our PID 1,
5371 * let's grant the containers a raised RLIMIT_NOFILE hard limit by default,
5372 * so that container userspace gets similar resources as host userspace
5373 * gets. */
5374 buffer = kernel_defaults[rl];
5375 buffer.rlim_max = MIN((rlim_t) read_nr_open(), (rlim_t) HIGH_RLIMIT_NOFILE);
bf428efb
LP		 5376 v = &buffer;
5377 } else
5378 v = kernel_defaults + rl;
5379
5380 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
5381 if (!arg_rlimit[rl])
5382 return log_oom();
5383 }
5384
5385 if (DEBUG_LOGGING) {
5386 _cleanup_free_ char *k = NULL;
5387
5388 (void) rlimit_format(arg_rlimit[rl], &k);
5389 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
5390 }
5391 }
5392
5393 return 0;
5394}
5395
287b7376 5396static int cant_be_in_netns(void) {
254d1313 5397 _cleanup_close_ int fd = -EBADF;
287b7376
LP		 5398 struct ucred ucred;
5399 int r;
5400
5401 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
5402 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
5403 * nice message. */
5404
5405 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
5406 return 0;
5407
5408 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
5409 if (fd < 0)
5410 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
5411
1861986a
LP		 5412 r = connect_unix_path(fd, AT_FDCWD, "/run/udev/control");
5413 if (r < 0) {
5414 if (r == -ENOENT || ERRNO_IS_DISCONNECT(r))
287b7376
LP		 5415 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5416 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
5417
1861986a 5418 return log_error_errno(r, "Failed to connect socket to udev control socket: %m");
287b7376
LP		 5419 }
5420
5421 r = getpeercred(fd, &ucred);
5422 if (r < 0)
5423 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
5424
f7a2dc3d 5425 r = in_same_namespace(ucred.pid, 0, NAMESPACE_NET);
287b7376 5426 if (r < 0)
f7a2dc3d
CB		 5427 return log_error_errno(r, "Failed to determine network namespace of udev: %m");
5428 if (r == 0)
287b7376
LP		 5429 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5430 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
5431 return 0;
5432}
5433
44dbef90 5434static int run(int argc, char *argv[]) {
4c27749b 5435 bool remove_directory = false, remove_image = false, veth_created = false, remove_tmprootdir = false;
5bb1d7fb 5436 _cleanup_close_ int master = -EBADF;
03cfe0d5 5437 _cleanup_fdset_free_ FDSet *fds = NULL;
2d845785 5438 int r, n_fd_passed, ret = EXIT_SUCCESS;
5aa3eba5 5439 char veth_name[IFNAMSIZ] = "";
761cf19d 5440 struct ExposeArgs expose_args = {};
8e766630 5441 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
c67b0082 5442 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
2d845785 5443 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
18b5886e 5444 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
761cf19d 5445 _cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
7bf011e3 5446 pid_t pid = 0;
03cfe0d5
LP		 5447
5448 log_parse_environment();
5449 log_open();
415fc41c 5450
03cfe0d5
LP		 5451 r = parse_argv(argc, argv);
5452 if (r <= 0)
5453 goto finish;
5454
38ee19c0
ZJS		 5455 if (geteuid() != 0) {
5456 r = log_warning_errno(SYNTHETIC_ERRNO(EPERM),
5457 argc >= 2 ? "Need to be root." :
5458 "Need to be root (and some arguments are usually required).\nHint: try --help");
03cfe0d5 5459 goto finish;
38ee19c0 5460 }
fba868fa 5461
287b7376
LP		 5462 r = cant_be_in_netns();
5463 if (r < 0)
5464 goto finish;
5465
bf428efb
LP		 5466 r = initialize_rlimits();
5467 if (r < 0)
5468 goto finish;
5469
de40a303
LP		 5470 r = load_oci_bundle();
5471 if (r < 0)
5472 goto finish;
5473
f757855e
LP		 5474 r = determine_names();
5475 if (r < 0)
5476 goto finish;
5477
5478 r = load_settings();
5479 if (r < 0)
5480 goto finish;
5481
d4d99bc6 5482 r = cg_unified();
5eee8290
LP		 5483 if (r < 0) {
5484 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
5485 goto finish;
5486 }
5487
f757855e
LP		 5488 r = verify_arguments();
5489 if (r < 0)
5490 goto finish;
03cfe0d5 5491
49048684
ZJS		 5492 /* Reapply environment settings. */
5493 (void) detect_unified_cgroup_hierarchy_from_environment();
8199d554 5494
2949ff26
LP		 5495 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
5496 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
5497 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
9c274488 5498 (void) ignore_signals(SIGPIPE);
2949ff26 5499
03cfe0d5
LP		 5500 n_fd_passed = sd_listen_fds(false);
5501 if (n_fd_passed > 0) {
5502 r = fdset_new_listen_fds(&fds, false);
5503 if (r < 0) {
5504 log_error_errno(r, "Failed to collect file descriptors: %m");
5505 goto finish;
5506 }
5507 }
5508
83e803a9
ZJS		 5509 /* The "default" umask. This is appropriate for most file and directory
5510 * operations performed by nspawn, and is the umask that will be used for
5511 * the child. Functions like copy_devnodes() change the umask temporarily. */
5512 umask(0022);
5513
03cfe0d5
LP		 5514 if (arg_directory) {
5515 assert(!arg_image);
5516
b35ca61a
LP		 5517 /* Safety precaution: let's not allow running images from the live host OS image, as long as
5518 * /var from the host will propagate into container dynamically (because bad things happen if
5519 * two systems write to the same /var). Let's allow it for the special cases where /var is
5520 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
5521 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
1406bd66
LP		 5522 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5523 "Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
03cfe0d5
LP		 5524 goto finish;
5525 }
5526
5527 if (arg_ephemeral) {
5528 _cleanup_free_ char *np = NULL;
5529
8d4aa2bb 5530 r = chase_symlinks_and_update(&arg_directory, 0);
3f342ec4
LP		 5531 if (r < 0)
5532 goto finish;
5533
7bf011e3
LP		 5534 /* If the specified path is a mount point we generate the new snapshot immediately
5535 * inside it under a random name. However if the specified is not a mount point we
5536 * create the new snapshot in the parent directory, just next to it. */
e1873695 5537 r = path_is_mount_point(arg_directory, NULL, 0);
03cfe0d5
LP		 5538 if (r < 0) {
5539 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5540 goto finish;
5541 }
5542 if (r > 0)
770b5ce4 5543 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 5544 else
770b5ce4 5545 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5 5546 if (r < 0) {
0f3be6ca 5547 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
03cfe0d5
LP		 5548 goto finish;
5549 }
5550
6992459c 5551 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
162392b7 5552 * only owned by us and no one else. */
6992459c 5553 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
03cfe0d5
LP		 5554 if (r < 0) {
5555 log_error_errno(r, "Failed to lock %s: %m", np);
5556 goto finish;
5557 }
5558
7bf011e3
LP		 5559 {
5560 BLOCK_SIGNALS(SIGINT);
5561 r = btrfs_subvol_snapshot(arg_directory, np,
5562 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5563 BTRFS_SNAPSHOT_FALLBACK_COPY |
5564 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5565 BTRFS_SNAPSHOT_RECURSIVE |
5566 BTRFS_SNAPSHOT_QUOTA |
5567 BTRFS_SNAPSHOT_SIGINT);
5568 }
5569 if (r == -EINTR) {
5570 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5571 goto finish;
5572 }
03cfe0d5
LP		 5573 if (r < 0) {
5574 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5575 goto finish;
ec16945e
LP		 5576 }
5577
1cc6c93a 5578 free_and_replace(arg_directory, np);
17cbb288 5579 remove_directory = true;
30535c16 5580 } else {
cb638b5e 5581 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
8d4aa2bb
LP		 5582 if (r < 0)
5583 goto finish;
5584
30535c16
LP		 5585 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5586 if (r == -EBUSY) {
5587 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5588 goto finish;
5589 }
5590 if (r < 0) {
5591 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
476b8254 5592 goto finish;
30535c16
LP		 5593 }
5594
5595 if (arg_template) {
8d4aa2bb 5596 r = chase_symlinks_and_update(&arg_template, 0);
3f342ec4
LP		 5597 if (r < 0)
5598 goto finish;
5599
7bf011e3
LP		 5600 {
5601 BLOCK_SIGNALS(SIGINT);
5602 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5603 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5604 BTRFS_SNAPSHOT_FALLBACK_COPY |
5605 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5606 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5607 BTRFS_SNAPSHOT_RECURSIVE |
5608 BTRFS_SNAPSHOT_QUOTA |
5609 BTRFS_SNAPSHOT_SIGINT);
5610 }
ff6c6cc1
LP		 5611 if (r == -EEXIST)
5612 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5613 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
7bf011e3
LP		 5614 else if (r == -EINTR) {
5615 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5616 goto finish;
5617 } else if (r < 0) {
83521414 5618 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16 5619 goto finish;
ff6c6cc1
LP		 5620 } else
5621 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5622 "Populated %s from template %s.", arg_directory, arg_template);
30535c16 5623 }
ec16945e
LP		 5624 }
5625
7732f92b 5626 if (arg_start_mode == START_BOOT) {
aff7ae0d 5627 _cleanup_free_ char *b = NULL;
a5201ed6 5628 const char *p;
c9fe05e0 5629
aff7ae0d
LP		 5630 if (arg_pivot_root_new) {
5631 b = path_join(arg_directory, arg_pivot_root_new);
5632 if (!b)
5633 return log_oom();
5634
5635 p = b;
5636 } else
a5201ed6 5637 p = arg_directory;
c9fe05e0
AR		 5638
5639 if (path_is_os_tree(p) <= 0) {
aff7ae0d
LP		 5640 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5641 "Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
1b9e5b12
LP		 5642 goto finish;
5643 }
5644 } else {
aff7ae0d 5645 _cleanup_free_ char *p = NULL;
c9fe05e0 5646
a5201ed6 5647 if (arg_pivot_root_new)
aff7ae0d 5648 p = path_join(arg_directory, arg_pivot_root_new, "/usr/");
a5201ed6 5649 else
aff7ae0d
LP		 5650 p = path_join(arg_directory, "/usr/");
5651 if (!p)
5652 return log_oom();
1b9e5b12 5653
aff7ae0d
LP		 5654 if (laccess(p, F_OK) < 0) {
5655 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5656 "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
1b9e5b12 5657 goto finish;
1b9e5b12
LP		 5658 }
5659 }
ec16945e 5660
6b9132a9 5661 } else {
d04faa4e 5662 DissectImageFlags dissect_image_flags =
4b5de5dd 5663 DISSECT_IMAGE_GENERIC_ROOT |
d04faa4e
LP		 5664 DISSECT_IMAGE_REQUIRE_ROOT |
5665 DISSECT_IMAGE_RELAX_VAR_CHECK |
73d88b80
LP		 5666 DISSECT_IMAGE_USR_NO_ROOT |
5667 DISSECT_IMAGE_ADD_PARTITION_DEVICES |
5668 DISSECT_IMAGE_PIN_PARTITION_DEVICES;
ec16945e
LP		 5669 assert(arg_image);
5670 assert(!arg_template);
5671
8d4aa2bb 5672 r = chase_symlinks_and_update(&arg_image, 0);
3f342ec4
LP		 5673 if (r < 0)
5674 goto finish;
5675
0f3be6ca
LP		 5676 if (arg_ephemeral) {
5677 _cleanup_free_ char *np = NULL;
5678
5679 r = tempfn_random(arg_image, "machine.", &np);
5680 if (r < 0) {
5681 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5682 goto finish;
5683 }
5684
6992459c
LP		 5685 /* Always take an exclusive lock on our own ephemeral copy. */
5686 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
0f3be6ca
LP		 5687 if (r < 0) {
5688 r = log_error_errno(r, "Failed to create image lock: %m");
5689 goto finish;
5690 }
5691
7bf011e3
LP		 5692 {
5693 BLOCK_SIGNALS(SIGINT);
5694 r = copy_file(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600, FS_NOCOW_FL, FS_NOCOW_FL, COPY_REFLINK|COPY_CRTIME|COPY_SIGINT);
5695 }
5696 if (r == -EINTR) {
5697 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5698 goto finish;
5699 }
0f3be6ca
LP		 5700 if (r < 0) {
5701 r = log_error_errno(r, "Failed to copy image file: %m");
5702 goto finish;
5703 }
5704
1cc6c93a 5705 free_and_replace(arg_image, np);
0f3be6ca
LP		 5706 remove_image = true;
5707 } else {
5708 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5709 if (r == -EBUSY) {
5710 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5711 goto finish;
5712 }
5713 if (r < 0) {
5714 r = log_error_errno(r, "Failed to create image lock: %m");
5715 goto finish;
5716 }
4623e8e6 5717
89e62e0b
LP		 5718 r = verity_settings_load(
5719 &arg_verity_settings,
5720 arg_image, NULL, NULL);
e7cbe5cb
LB		 5721 if (r < 0) {
5722 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5723 goto finish;
78ebe980 5724 }
89e62e0b
LP		 5725
5726 if (arg_verity_settings.data_path)
5727 dissect_image_flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
30535c16
LP		 5728 }
5729
c67b0082 5730 if (!mkdtemp(tmprootdir)) {
0f3be6ca 5731 r = log_error_errno(errno, "Failed to create temporary directory: %m");
6b9132a9 5732 goto finish;
1b9e5b12 5733 }
6b9132a9 5734
c67b0082
LP		 5735 remove_tmprootdir = true;
5736
5737 arg_directory = strdup(tmprootdir);
1b9e5b12
LP		 5738 if (!arg_directory) {
5739 r = log_oom();
5740 goto finish;
6b9132a9 5741 }
88213476 5742
89e62e0b
LP		 5743 r = loop_device_make_by_path(
5744 arg_image,
5745 arg_read_only ? O_RDONLY : O_RDWR,
22ee78a8 5746 /* sector_size= */ UINT32_MAX,
89e62e0b 5747 FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
7f52206a 5748 LOCK_SH,
89e62e0b 5749 &loop);
2d845785
LP		 5750 if (r < 0) {
5751 log_error_errno(r, "Failed to set up loopback block device: %m");
842f3b0f
LP		 5752 goto finish;
5753 }
1b9e5b12 5754
bad31660 5755 r = dissect_loop_device_and_warn(
bad31660 5756 loop,
89e62e0b 5757 &arg_verity_settings,
18d73705 5758 NULL,
e7cbe5cb 5759 dissect_image_flags,
e0f9e7bd 5760 &dissected_image);
2d845785 5761 if (r == -ENOPKG) {
4526113f 5762 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
2d845785
LP		 5763 log_notice("Note that the disk image needs to\n"
5764 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5765 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
db811444 5766 " c) or follow https://uapi-group.org/specifications/specs/discoverable_partitions_specification\n"
2d845785
LP		 5767 " d) or contain a file system without a partition table\n"
5768 "in order to be bootable with systemd-nspawn.");
1b9e5b12 5769 goto finish;
2d845785 5770 }
4526113f 5771 if (r < 0)
842f3b0f 5772 goto finish;
1b9e5b12 5773
88b3300f
LP		 5774 r = dissected_image_load_verity_sig_partition(
5775 dissected_image,
5776 loop->fd,
5777 &arg_verity_settings);
5778 if (r < 0)
5779 goto finish;
5780
8ee9615e
LP		 5781 if (dissected_image->has_verity && !arg_verity_settings.root_hash && !dissected_image->has_verity_sig)
5782 log_notice("Note: image %s contains verity information, but no root hash specified and no embedded "
5783 "root hash signature found! Proceeding without integrity checking.", arg_image);
4623e8e6 5784
89e62e0b
LP		 5785 r = dissected_image_decrypt_interactively(
5786 dissected_image,
5787 NULL,
5788 &arg_verity_settings,
e330f97a 5789 0);
1b9e5b12
LP		 5790 if (r < 0)
5791 goto finish;
0f3be6ca
LP		 5792
5793 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5794 if (remove_image && unlink(arg_image) >= 0)
5795 remove_image = false;
4c27749b
LP		 5796
5797 if (arg_architecture < 0)
5798 arg_architecture = dissected_image_architecture(dissected_image);
842f3b0f 5799 }
842f3b0f 5800
86c0dd4a 5801 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5a8af538
LP		 5802 if (r < 0)
5803 goto finish;
5804
de40a303
LP		 5805 if (arg_console_mode < 0)
5806 arg_console_mode =
5807 isatty(STDIN_FILENO) > 0 &&
5808 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
9c857b9d 5809
de40a303
LP		 5810 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5811 arg_quiet = true;
a258bf26 5812
9c857b9d 5813 if (!arg_quiet)
c85c2f79 5814 log_info("Spawning container %s on %s.\nPress Ctrl-] three times within 1s to kill container.",
9c857b9d
LP		 5815 arg_machine, arg_image ?: arg_directory);
5816
988851b6 5817 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, SIGRTMIN+18, -1) >= 0);
a258bf26 5818
66edd963 5819 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
03cfe0d5
LP		 5820 r = log_error_errno(errno, "Failed to become subreaper: %m");
5821 goto finish;
5822 }
5823
761cf19d
FW		 5824 if (arg_expose_ports) {
5825 r = fw_ctx_new(&fw_ctx);
5826 if (r < 0) {
5827 log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
5828 goto finish;
5829 }
5830 expose_args.fw_ctx = fw_ctx;
5831 }
d87be9b0 5832 for (;;) {
3acc84eb 5833 r = run_container(dissected_image,
44dbef90
LP		 5834 fds,
5835 veth_name, &veth_created,
761cf19d 5836 &expose_args, &master,
44dbef90 5837 &pid, &ret);
b0067625 5838 if (r <= 0)
d87be9b0 5839 break;
d87be9b0 5840 }
88213476
LP		 5841
5842finish:
04f590a4
LP		 5843 (void) sd_notify(false,
5844 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5845 "STOPPING=1\nSTATUS=Terminating...");
af4ec430 5846
9444b1f2 5847 if (pid > 0)
c67b0082 5848 (void) kill(pid, SIGKILL);
88213476 5849
503546da 5850 /* Try to flush whatever is still queued in the pty */
6a0f896b 5851 if (master >= 0) {
f5fbe71d 5852 (void) copy_bytes(master, STDOUT_FILENO, UINT64_MAX, 0);
6a0f896b
LP		 5853 master = safe_close(master);
5854 }
5855
5856 if (pid > 0)
5857 (void) wait_for_terminate(pid, NULL);
503546da 5858
50ebcf6c
LP		 5859 pager_close();
5860
17cbb288 5861 if (remove_directory && arg_directory) {
ec16945e
LP		 5862 int k;
5863
17cbb288 5864 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
ec16945e 5865 if (k < 0)
17cbb288 5866 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
ec16945e
LP		 5867 }
5868
0f3be6ca
LP		 5869 if (remove_image && arg_image) {
5870 if (unlink(arg_image) < 0)
5871 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5872 }
5873
c67b0082
LP		 5874 if (remove_tmprootdir) {
5875 if (rmdir(tmprootdir) < 0)
5876 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5877 }
5878
785890ac
LP		 5879 if (arg_machine) {
5880 const char *p;
5881
63c372cb 5882 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 5883 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 5884 }
5885
deff68e7
FW		 5886 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET, &expose_args.address4);
5887 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET6, &expose_args.address6);
7513c5b8
LP		 5888
5889 if (veth_created)
5890 (void) remove_veth_links(veth_name, arg_network_veth_extra);
22b28dfd 5891 (void) remove_bridge(arg_network_zone);
f757855e 5892
f757855e
LP		 5893 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5894 expose_port_free_all(arg_expose_ports);
bf428efb 5895 rlimit_free_all(arg_rlimit);
b2645747 5896 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
3652872a 5897 credential_free_all(arg_credentials, arg_n_credentials);
6d0b55c2 5898
44dbef90
LP		 5899 if (r < 0)
5900 return r;
5901
5902 return ret;
88213476 5903}
44dbef90
LP		 5904
5905DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.