]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
condition: use proc_cmdline_strv()
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
88213476 2
349cc4a5 3#if HAVE_BLKID
8fe0087e 4#endif
88213476 5#include <errno.h>
88213476 6#include <getopt.h>
503f480f 7#include <linux/fs.h>
1b9e5b12 8#include <linux/loop.h>
349cc4a5 9#if HAVE_SELINUX
8fe0087e 10#include <selinux/selinux.h>
1b9e5b12 11#endif
8fe0087e 12#include <stdlib.h>
8fe0087e 13#include <sys/file.h>
335d2ead 14#include <sys/ioctl.h>
8fe0087e
LP		 15#include <sys/personality.h>
16#include <sys/prctl.h>
17#include <sys/types.h>
6916b164 18#include <sys/wait.h>
335d2ead 19#include <termios.h>
8fe0087e 20#include <unistd.h>
1b9e5b12 21
b053cd5f 22#include "sd-bus.h"
1f0cd86b 23#include "sd-daemon.h"
1f0cd86b 24#include "sd-id128.h"
8fe0087e 25
b5efdb8a 26#include "alloc-util.h"
8fe0087e
LP		 27#include "barrier.h"
28#include "base-filesystem.h"
29#include "blkid-util.h"
30#include "btrfs-util.h"
d6b4d1c7 31#include "build.h"
b8ea7a6e 32#include "bus-error.h"
b053cd5f 33#include "bus-util.h"
8fe0087e 34#include "cap-list.h"
430f0182 35#include "capability-util.h"
04d391da 36#include "cgroup-util.h"
f461a28d 37#include "chase.h"
988851b6 38#include "common-signal.h"
8fe0087e 39#include "copy.h"
d107bb7d 40#include "cpu-set-util.h"
786d19fd 41#include "creds-util.h"
4fc9982c 42#include "dev-setup.h"
57f1b61b 43#include "discover-image.h"
2d845785 44#include "dissect-image.h"
8fe0087e 45#include "env-util.h"
3652872a 46#include "escape.h"
3ffd4af2 47#include "fd-util.h"
842f3b0f 48#include "fdset.h"
a5c32cff 49#include "fileio.h"
f97b34a6 50#include "format-util.h"
f4f15635 51#include "fs-util.h"
1b9e5b12 52#include "gpt.h"
4623e8e6 53#include "hexdecoct.h"
e2054217 54#include "hostname-setup.h"
8fe0087e 55#include "hostname-util.h"
910fd145 56#include "id128-util.h"
3652872a 57#include "io-util.h"
8fe0087e 58#include "log.h"
2d845785 59#include "loop-util.h"
8fe0087e 60#include "loopback-setup.h"
8fe0087e 61#include "macro.h"
44dbef90 62#include "main-func.h"
f5947a5e 63#include "missing_sched.h"
8fe0087e 64#include "mkdir.h"
4349cd7c 65#include "mount-util.h"
049af8ad 66#include "mountpoint-util.h"
0cb8e3d1 67#include "namespace-util.h"
8fe0087e 68#include "netlink-util.h"
2f893044 69#include "nspawn-bind-user.h"
07630cea 70#include "nspawn-cgroup.h"
3652872a 71#include "nspawn-creds.h"
3603efde 72#include "nspawn-def.h"
07630cea
LP		 73#include "nspawn-expose-ports.h"
74#include "nspawn-mount.h"
75#include "nspawn-network.h"
de40a303 76#include "nspawn-oci.h"
7336138e 77#include "nspawn-patch-uid.h"
07630cea 78#include "nspawn-register.h"
910fd145 79#include "nspawn-seccomp.h"
07630cea
LP		 80#include "nspawn-settings.h"
81#include "nspawn-setuid.h"
7732f92b 82#include "nspawn-stub-pid1.h"
c9394f4f 83#include "nspawn-util.h"
91181e07 84#include "nspawn.h"
d8b4d14d 85#include "nulstr-util.h"
d58ad743 86#include "os-util.h"
50ebcf6c 87#include "pager.h"
614b022c 88#include "parse-argument.h"
6bedfcbb 89#include "parse-util.h"
294bf0c3 90#include "pretty-print.h"
0b452006 91#include "process-util.h"
8fe0087e
LP		 92#include "ptyfwd.h"
93#include "random-util.h"
8869a0b4 94#include "raw-clone.h"
86775e35 95#include "resolve-util.h"
bf428efb 96#include "rlimit-util.h"
8fe0087e 97#include "rm-rf.h"
de40a303
LP		 98#if HAVE_SECCOMP
99#include "seccomp-util.h"
100#endif
68b02049 101#include "selinux-util.h"
8fe0087e 102#include "signal-util.h"
2583fbea 103#include "socket-util.h"
8fcde012 104#include "stat-util.h"
15a5e950 105#include "stdio-util.h"
5c828e66 106#include "string-table.h"
07630cea 107#include "string-util.h"
8fe0087e 108#include "strv.h"
de40a303 109#include "sysctl-util.h"
8fe0087e 110#include "terminal-util.h"
e4de7287 111#include "tmpfile-util.h"
affb60b1 112#include "umask-util.h"
43c3fb46 113#include "unit-name.h"
b1d4f8e1 114#include "user-util.h"
e9642be2 115
e96ceaba
LP		 116/* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
117#define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
e79581dd 118#define NSPAWN_MOUNT_TUNNEL "/run/host/incoming"
0e7ac751 119
2a49b612
ZJS		 120#define EXIT_FORCE_RESTART 133
121
113cea80
DH		 122typedef enum ContainerStatus {
123 CONTAINER_TERMINATED,
6145bb4f 124 CONTAINER_REBOOTED,
113cea80
DH		 125} ContainerStatus;
126
88213476 127static char *arg_directory = NULL;
ec16945e 128static char *arg_template = NULL;
5f932eb9 129static char *arg_chdir = NULL;
b53ede69
PW		 130static char *arg_pivot_root_new = NULL;
131static char *arg_pivot_root_old = NULL;
687d0825 132static char *arg_user = NULL;
de40a303
LP		 133static uid_t arg_uid = UID_INVALID;
134static gid_t arg_gid = GID_INVALID;
135static gid_t* arg_supplementary_gids = NULL;
136static size_t arg_n_supplementary_gids = 0;
9444b1f2 137static sd_id128_t arg_uuid = {};
3a9530e5
LP		 138static char *arg_machine = NULL; /* The name used by the host to refer to this */
139static char *arg_hostname = NULL; /* The name the payload sees by default */
c74e630d
LP		 140static const char *arg_selinux_context = NULL;
141static const char *arg_selinux_apifs_context = NULL;
de40a303 142static char *arg_slice = NULL;
ff01d048 143static bool arg_private_network = false;
bc2f673e 144static bool arg_read_only = false;
7732f92b 145static StartMode arg_start_mode = START_PID1;
ec16945e 146static bool arg_ephemeral = false;
57fb9fb5 147static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 148static bool arg_link_journal_try = false;
520e0d54 149static uint64_t arg_caps_retain =
50b52222
LP		 150 (1ULL << CAP_AUDIT_CONTROL) |
151 (1ULL << CAP_AUDIT_WRITE) |
5076f0cc
LP		 152 (1ULL << CAP_CHOWN) |
153 (1ULL << CAP_DAC_OVERRIDE) |
154 (1ULL << CAP_DAC_READ_SEARCH) |
155 (1ULL << CAP_FOWNER) |
156 (1ULL << CAP_FSETID) |
157 (1ULL << CAP_IPC_OWNER) |
158 (1ULL << CAP_KILL) |
159 (1ULL << CAP_LEASE) |
160 (1ULL << CAP_LINUX_IMMUTABLE) |
50b52222 161 (1ULL << CAP_MKNOD) |
5076f0cc
LP		 162 (1ULL << CAP_NET_BIND_SERVICE) |
163 (1ULL << CAP_NET_BROADCAST) |
164 (1ULL << CAP_NET_RAW) |
5076f0cc 165 (1ULL << CAP_SETFCAP) |
50b52222 166 (1ULL << CAP_SETGID) |
5076f0cc
LP		 167 (1ULL << CAP_SETPCAP) |
168 (1ULL << CAP_SETUID) |
169 (1ULL << CAP_SYS_ADMIN) |
50b52222 170 (1ULL << CAP_SYS_BOOT) |
5076f0cc
LP		 171 (1ULL << CAP_SYS_CHROOT) |
172 (1ULL << CAP_SYS_NICE) |
173 (1ULL << CAP_SYS_PTRACE) |
d87be9b0 174 (1ULL << CAP_SYS_RESOURCE) |
50b52222 175 (1ULL << CAP_SYS_TTY_CONFIG);
88fc9c9b 176static uint64_t arg_caps_ambient = 0;
de40a303 177static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
5a8af538 178static CustomMount *arg_custom_mounts = NULL;
88614c8a 179static size_t arg_n_custom_mounts = 0;
f4889f65 180static char **arg_setenv = NULL;
284c0b91 181static bool arg_quiet = false;
eb91eb18 182static bool arg_register = true;
89f7c846 183static bool arg_keep_unit = false;
aa28aefe 184static char **arg_network_interfaces = NULL;
c74e630d 185static char **arg_network_macvlan = NULL;
4bbfe7ad 186static char **arg_network_ipvlan = NULL;
69c79d3c 187static bool arg_network_veth = false;
f6d6bad1 188static char **arg_network_veth_extra = NULL;
f757855e 189static char *arg_network_bridge = NULL;
22b28dfd 190static char *arg_network_zone = NULL;
d7bea6b6 191static char *arg_network_namespace_path = NULL;
bb068de0 192static PagerFlags arg_pager_flags = 0;
050f7277 193static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 194static char *arg_image = NULL;
de40a303 195static char *arg_oci_bundle = NULL;
f757855e 196static VolatileMode arg_volatile_mode = VOLATILE_NO;
6d0b55c2 197static ExposePort *arg_expose_ports = NULL;
f36933fe 198static char **arg_property = NULL;
de40a303 199static sd_bus_message *arg_property_message = NULL;
0de7acce 200static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
6dac160c 201static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
6c045a99 202static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
c6c8f6e2 203static int arg_kill_signal = 0;
5da38d07 204static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
f757855e
LP		 205static SettingsMask arg_settings_mask = 0;
206static int arg_settings_trusted = -1;
207static char **arg_parameters = NULL;
6aadfa4c 208static const char *arg_container_service_name = "systemd-nspawn";
9c1e04d0 209static bool arg_notify_ready = false;
5a8ff0e6 210static bool arg_use_cgns = true;
0c582db0 211static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
1099ceeb 212static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
aee36b4e 213static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
6b000af4
LP		 214static char **arg_syscall_allow_list = NULL;
215static char **arg_syscall_deny_list = NULL;
de40a303
LP		 216#if HAVE_SECCOMP
217static scmp_filter_ctx arg_seccomp = NULL;
218#endif
bf428efb 219static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
66edd963 220static bool arg_no_new_privileges = false;
81f345df
LP		 221static int arg_oom_score_adjust = 0;
222static bool arg_oom_score_adjust_set = false;
0985c7c4 223static CPUSet arg_cpu_set = {};
09d423e9 224static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
1688841f 225static TimezoneMode arg_timezone = TIMEZONE_AUTO;
f5fbe71d 226static unsigned arg_console_width = UINT_MAX, arg_console_height = UINT_MAX;
de40a303
LP		 227static DeviceNode* arg_extra_nodes = NULL;
228static size_t arg_n_extra_nodes = 0;
229static char **arg_sysctl = NULL;
230static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
3652872a
LP		 231static Credential *arg_credentials = NULL;
232static size_t arg_n_credentials = 0;
2f893044 233static char **arg_bind_user = NULL;
4a4654e0 234static bool arg_suppress_sync = false;
3603f151 235static char *arg_settings_filename = NULL;
4c27749b 236static Architecture arg_architecture = _ARCHITECTURE_INVALID;
88213476 237
6145bb4f
LP		 238STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
239STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
240STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
241STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
242STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
243STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
244STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
245STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
246STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
247STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
248STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
249STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
250STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
251STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
252STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
253STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
254STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
255STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
256STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
257STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
258STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
259STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
260STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
89e62e0b 261STATIC_DESTRUCTOR_REGISTER(arg_verity_settings, verity_settings_done);
6b000af4
LP		 262STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
263STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
6145bb4f
LP		 264#if HAVE_SECCOMP
265STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
266#endif
0985c7c4 267STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
6145bb4f 268STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
2f893044 269STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
3603f151 270STATIC_DESTRUCTOR_REGISTER(arg_settings_filename, freep);
6145bb4f 271
dce66ffe
ZJS		 272static int handle_arg_console(const char *arg) {
273 if (streq(arg, "help")) {
10e8a60b
LP		 274 puts("autopipe\n"
275 "interactive\n"
dce66ffe 276 "passive\n"
10e8a60b
LP		 277 "pipe\n"
278 "read-only");
dce66ffe
ZJS		 279 return 0;
280 }
281
282 if (streq(arg, "interactive"))
283 arg_console_mode = CONSOLE_INTERACTIVE;
284 else if (streq(arg, "read-only"))
285 arg_console_mode = CONSOLE_READ_ONLY;
286 else if (streq(arg, "passive"))
287 arg_console_mode = CONSOLE_PASSIVE;
554c4beb
LP		 288 else if (streq(arg, "pipe")) {
289 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
290 log_full(arg_quiet ? LOG_DEBUG : LOG_NOTICE,
291 "Console mode 'pipe' selected, but standard input/output are connected to an interactive TTY. "
292 "Most likely you want to use 'interactive' console mode for proper interactivity and shell job control. "
293 "Proceeding anyway.");
294
dce66ffe 295 arg_console_mode = CONSOLE_PIPE;
10e8a60b
LP		 296 } else if (streq(arg, "autopipe")) {
297 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
298 arg_console_mode = CONSOLE_INTERACTIVE;
299 else
300 arg_console_mode = CONSOLE_PIPE;
554c4beb 301 } else
dce66ffe
ZJS		 302 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
303
304 arg_settings_mask |= SETTING_CONSOLE_MODE;
305 return 1;
306}
307
37ec0fdd
LP		 308static int help(void) {
309 _cleanup_free_ char *link = NULL;
310 int r;
311
384c2c32 312 pager_open(arg_pager_flags);
50ebcf6c 313
37ec0fdd
LP		 314 r = terminal_urlify_man("systemd-nspawn", "1", &link);
315 if (r < 0)
316 return log_oom();
317
25148653 318 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
37a92352 319 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
a8828ed9
DW		 320 " -h --help Show this help\n"
321 " --version Print version string\n"
69c79d3c 322 " -q --quiet Do not show status information\n"
bb068de0 323 " --no-pager Do not pipe output into a pager\n"
25148653
LP		 324 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
325 "%3$sImage:%4$s\n"
1b9e5b12 326 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 327 " --template=PATH Initialize root directory from template directory,\n"
328 " if missing\n"
329 " -x --ephemeral Run container with snapshot of root directory, and\n"
330 " remove it after exit\n"
25e68fd3
LP		 331 " -i --image=PATH Root file system disk image (or device node) for\n"
332 " the container\n"
de40a303 333 " --oci-bundle=PATH OCI bundle directory\n"
25148653
LP		 334 " --read-only Mount the root directory read-only\n"
335 " --volatile[=MODE] Run the system in volatile mode\n"
25e68fd3 336 " --root-hash=HASH Specify verity root hash for root disk image\n"
c2923fdc
LB		 337 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
338 " as a DER encoded PKCS7, either as a path to a file\n"
339 " or as an ASCII base64 encoded string prefixed by\n"
340 " 'base64:'\n"
e7cbe5cb 341 " --verity-data=PATH Specify hash device for verity\n"
25148653
LP		 342 " --pivot-root=PATH[:PATH]\n"
343 " Pivot root to given directory in the container\n\n"
344 "%3$sExecution:%4$s\n"
7732f92b 345 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
a8828ed9 346 " -b --boot Boot up full system (i.e. invoke init)\n"
5f932eb9 347 " --chdir=PATH Set working directory in the container\n"
0d2a0179 348 " -E --setenv=NAME[=VALUE] Pass an environment variable to PID 1\n"
25148653
LP		 349 " -u --user=USER Run the command under specified user or UID\n"
350 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
4a4654e0
LP		 351 " --notify-ready=BOOLEAN Receive notifications from the child init process\n"
352 " --suppress-sync=BOOLEAN\n"
353 " Suppress any form of disk data synchronization\n\n"
25148653 354 "%3$sSystem Identity:%4$s\n"
a8828ed9 355 " -M --machine=NAME Set the machine name for the container\n"
3a9530e5 356 " --hostname=NAME Override the hostname for the container\n"
25148653
LP		 357 " --uuid=UUID Set a specific machine UUID for the container\n\n"
358 "%3$sProperties:%4$s\n"
a8828ed9 359 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 360 " --property=NAME=VALUE Set scope unit property\n"
25148653
LP		 361 " --register=BOOLEAN Register container as machine\n"
362 " --keep-unit Do not register a scope for the machine, reuse\n"
363 " the service unit nspawn is running in\n\n"
364 "%3$sUser Namespacing:%4$s\n"
b917743d
YW		 365 " --private-users=no Run without user namespacing\n"
366 " --private-users=yes|pick|identity\n"
367 " Run within user namespace, autoselect UID/GID range\n"
368 " --private-users=UIDBASE[:NUIDS]\n"
90b4a64d 369 " Similar, but with user configured UID/GID range\n"
6c045a99
LP		 370 " --private-users-ownership=MODE\n"
371 " Adjust ('chown') or map ('map') OS tree ownership\n"
b917743d
YW		 372 " to private UID/GID range\n"
373 " -U Equivalent to --private-users=pick and\n"
374 " --private-users-ownership=auto\n\n"
25148653 375 "%3$sNetworking:%4$s\n"
69c79d3c
LP		 376 " --private-network Disable network in container\n"
377 " --network-interface=INTERFACE\n"
378 " Assign an existing network interface to the\n"
379 " container\n"
c74e630d
LP		 380 " --network-macvlan=INTERFACE\n"
381 " Create a macvlan network interface based on an\n"
382 " existing network interface to the container\n"
4bbfe7ad 383 " --network-ipvlan=INTERFACE\n"
387f6955 384 " Create an ipvlan network interface based on an\n"
4bbfe7ad 385 " existing network interface to the container\n"
a8eaaee7 386 " -n --network-veth Add a virtual Ethernet connection between host\n"
69c79d3c 387 " and container\n"
f6d6bad1
LP		 388 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
389 " Add an additional virtual Ethernet link between\n"
390 " host and container\n"
ab046dde 391 " --network-bridge=INTERFACE\n"
90b4a64d
ZJS		 392 " Add a virtual Ethernet connection to the container\n"
393 " and attach it to an existing bridge on the host\n"
394 " --network-zone=NAME Similar, but attach the new interface to an\n"
395 " an automatically managed bridge interface\n"
d7bea6b6
DP		 396 " --network-namespace-path=PATH\n"
397 " Set network namespace to the one represented by\n"
398 " the specified kernel namespace file node\n"
6d0b55c2 399 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
25148653
LP		 400 " Expose a container IP port on the host\n\n"
401 "%3$sSecurity:%4$s\n"
a8828ed9
DW		 402 " --capability=CAP In addition to the default, retain specified\n"
403 " capability\n"
404 " --drop-capability=CAP Drop the specified capability from the default set\n"
88fc9c9b
TH		 405 " --ambient-capability=CAP\n"
406 " Sets the specified capability for the started\n"
407 " process. Not useful if booting a machine.\n"
f4e803c8 408 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
960e4569
LP		 409 " --system-call-filter=LIST|~LIST\n"
410 " Permit/prohibit specific system calls\n"
25148653
LP		 411 " -Z --selinux-context=SECLABEL\n"
412 " Set the SELinux security context to be used by\n"
413 " processes in the container\n"
414 " -L --selinux-apifs-context=SECLABEL\n"
415 " Set the SELinux security context to be used by\n"
416 " API/tmpfs file systems in the container\n\n"
417 "%3$sResources:%4$s\n"
bf428efb 418 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
81f345df
LP		 419 " --oom-score-adjust=VALUE\n"
420 " Adjust the OOM score value for the payload\n"
f4e803c8
LP		 421 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
422 " --personality=ARCH Pick personality for this container\n\n"
25148653 423 "%3$sIntegration:%4$s\n"
09d423e9 424 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
1688841f 425 " --timezone=MODE Select mode of /etc/localtime initialization\n"
25148653
LP		 426 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
427 " host, try-guest, try-host\n"
428 " -j Equivalent to --link-journal=try-guest\n\n"
429 "%3$sMounts:%4$s\n"
5e5bfa6e
EY		 430 " --bind=PATH[:PATH[:OPTIONS]]\n"
431 " Bind mount a file or directory from the host into\n"
a8828ed9 432 " the container\n"
5e5bfa6e
EY		 433 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
434 " Similar, but creates a read-only bind mount\n"
de40a303
LP		 435 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
436 " it\n"
06c17c39 437 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 438 " --overlay=PATH[:PATH...]:PATH\n"
439 " Create an overlay mount from the host to \n"
440 " the container\n"
441 " --overlay-ro=PATH[:PATH...]:PATH\n"
2f893044
LP		 442 " Similar, but creates a read-only overlay mount\n"
443 " --bind-user=NAME Bind user from host to container\n\n"
25148653 444 "%3$sInput/Output:%4$s\n"
de40a303
LP		 445 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
446 " set up for the container.\n"
3652872a
LP		 447 " -P --pipe Equivalent to --console=pipe\n\n"
448 "%3$sCredentials:%4$s\n"
449 " --set-credential=ID:VALUE\n"
450 " Pass a credential with literal value to container.\n"
451 " --load-credential=ID:PATH\n"
452 " Load credential to pass to container from file or\n"
453 " AF_UNIX stream socket.\n"
bc556335
DDM		 454 "\nSee the %2$s for details.\n",
455 program_invocation_short_name,
456 link,
457 ansi_underline(),
458 ansi_normal(),
459 ansi_highlight(),
460 ansi_normal());
37ec0fdd
LP		 461
462 return 0;
88213476
LP		 463}
464
86c0dd4a 465static int custom_mount_check_all(void) {
88614c8a 466 size_t i;
5a8af538 467
5a8af538
LP		 468 for (i = 0; i < arg_n_custom_mounts; i++) {
469 CustomMount *m = &arg_custom_mounts[i];
470
0de7acce 471 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
6c045a99 472 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_OFF)
baaa35ad 473 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
c920b863 474 "--private-users-ownership=own may not be combined with custom root mounts.");
6c045a99 475 if (arg_uid_shift == UID_INVALID)
baaa35ad
ZJS		 476 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
477 "--private-users with automatic UID shift may not be combined with custom root mounts.");
825d5287 478 }
5a8af538
LP		 479 }
480
481 return 0;
482}
483
8199d554 484static int detect_unified_cgroup_hierarchy_from_environment(void) {
c78c095b 485 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
415fc41c 486 int r;
5da38d07 487
efdb0237 488 /* Allow the user to control whether the unified hierarchy is used */
c78c095b
ZJS		 489
490 e = getenv(var);
491 if (!e) {
d5fc5b2f 492 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
c78c095b
ZJS		 493 var = "UNIFIED_CGROUP_HIERARCHY";
494 e = getenv(var);
c78c095b
ZJS		 495 }
496
497 if (!isempty(e)) {
efdb0237
LP		 498 r = parse_boolean(e);
499 if (r < 0)
c78c095b 500 return log_error_errno(r, "Failed to parse $%s: %m", var);
5da38d07
TH		 501 if (r > 0)
502 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
503 else
504 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237
LP		 505 }
506
8199d554
LP		 507 return 0;
508}
509
510static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
511 int r;
512
75b0d8b8
ZJS		 513 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
514 * in the image actually supports. */
b4cccbc1
LP		 515 r = cg_all_unified();
516 if (r < 0)
517 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
518 if (r > 0) {
a8725a06
ZJS		 519 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
520 * routine only detects 231, so we'll have a false negative here for 230. */
7e6821ed 521 r = systemd_installation_has_version(directory, "230");
a8725a06
ZJS		 522 if (r < 0)
523 return log_error_errno(r, "Failed to determine systemd version in container: %m");
524 if (r > 0)
525 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
526 else
527 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
c22800e4 528 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2977724b 529 /* Mixed cgroup hierarchy support was added in 233 */
7e6821ed 530 r = systemd_installation_has_version(directory, "233");
0fd9563f
ZJS		 531 if (r < 0)
532 return log_error_errno(r, "Failed to determine systemd version in container: %m");
533 if (r > 0)
534 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
535 else
536 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
537 } else
5da38d07 538 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 539
8199d554
LP		 540 log_debug("Using %s hierarchy for container.",
541 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
542 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
543
efdb0237
LP		 544 return 0;
545}
546
8a99bd0c
ZJS		 547static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
548 uint64_t mask = 0;
549 int r;
550
551 for (;;) {
552 _cleanup_free_ char *t = NULL;
553
554 r = extract_first_word(&spec, &t, ",", 0);
555 if (r < 0)
556 return log_error_errno(r, "Failed to parse capability %s.", t);
557 if (r == 0)
558 break;
559
560 if (streq(t, "help")) {
561 for (int i = 0; i < capability_list_length(); i++) {
562 const char *name;
563
564 name = capability_to_name(i);
565 if (name)
566 puts(name);
567 }
568
569 return 0; /* quit */
570 }
571
572 if (streq(t, "all"))
f5fbe71d 573 mask = UINT64_MAX;
8a99bd0c
ZJS		 574 else {
575 r = capability_from_name(t);
576 if (r < 0)
577 return log_error_errno(r, "Failed to parse capability %s.", t);
578
579 mask |= 1ULL << r;
580 }
581 }
582
583 *ret_mask = mask;
584 return 1; /* continue */
585}
586
49048684 587static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
0c582db0
LB		 588 int r;
589
590 r = getenv_bool(name);
591 if (r == -ENXIO)
49048684 592 return 0;
0c582db0 593 if (r < 0)
49048684 594 return log_error_errno(r, "Failed to parse $%s: %m", name);
de40a303 595
0c582db0 596 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
de40a303 597 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
49048684 598 return 0;
0c582db0
LB		 599}
600
49048684 601static int parse_mount_settings_env(void) {
4f086aab 602 const char *e;
1099ceeb
LP		 603 int r;
604
605 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
49048684
ZJS		 606 if (r < 0 && r != -ENXIO)
607 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
1099ceeb
LP		 608 if (r >= 0)
609 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
4f086aab
SU		 610
611 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
49048684 612 if (streq_ptr(e, "network"))
4f086aab 613 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
4f086aab 614
49048684
ZJS		 615 else if (e) {
616 r = parse_boolean(e);
617 if (r < 0)
618 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
619
620 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
621 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
ab8ee0f2 622 }
4f086aab 623
49048684 624 return 0;
4f086aab
SU		 625}
626
49048684 627static int parse_environment(void) {
d5455d2f
LP		 628 const char *e;
629 int r;
630
49048684
ZJS		 631 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
632 if (r < 0)
633 return r;
634 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
635 if (r < 0)
636 return r;
637 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
638 if (r < 0)
639 return r;
640 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
641 if (r < 0)
642 return r;
d5455d2f 643
49048684
ZJS		 644 r = parse_mount_settings_env();
645 if (r < 0)
646 return r;
d5455d2f 647
489fae52
ZJS		 648 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
649 * even if it is supported. If not supported, it has no effect. */
de40a303 650 if (!cg_ns_supported())
489fae52 651 arg_use_cgns = false;
de40a303
LP		 652 else {
653 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
654 if (r < 0) {
655 if (r != -ENXIO)
49048684 656 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
de40a303
LP		 657
658 arg_use_cgns = true;
659 } else {
660 arg_use_cgns = r > 0;
661 arg_settings_mask |= SETTING_USE_CGNS;
662 }
663 }
d5455d2f
LP		 664
665 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
666 if (e)
667 arg_container_service_name = e;
668
4a4654e0
LP		 669 r = getenv_bool("SYSTEMD_SUPPRESS_SYNC");
670 if (r >= 0)
671 arg_suppress_sync = r;
672 else if (r != -ENXIO)
673 log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
674
49048684 675 return detect_unified_cgroup_hierarchy_from_environment();
d5455d2f
LP		 676}
677
88213476 678static int parse_argv(int argc, char *argv[]) {
a41fe3a2 679 enum {
acbeb427
ZJS		 680 ARG_VERSION = 0x100,
681 ARG_PRIVATE_NETWORK,
bc2f673e 682 ARG_UUID,
5076f0cc 683 ARG_READ_ONLY,
57fb9fb5 684 ARG_CAPABILITY,
88fc9c9b 685 ARG_AMBIENT_CAPABILITY,
420c7379 686 ARG_DROP_CAPABILITY,
17fe0523
LP		 687 ARG_LINK_JOURNAL,
688 ARG_BIND,
f4889f65 689 ARG_BIND_RO,
06c17c39 690 ARG_TMPFS,
5a8af538
LP		 691 ARG_OVERLAY,
692 ARG_OVERLAY_RO,
de40a303 693 ARG_INACCESSIBLE,
eb91eb18 694 ARG_SHARE_SYSTEM,
89f7c846 695 ARG_REGISTER,
aa28aefe 696 ARG_KEEP_UNIT,
69c79d3c 697 ARG_NETWORK_INTERFACE,
c74e630d 698 ARG_NETWORK_MACVLAN,
4bbfe7ad 699 ARG_NETWORK_IPVLAN,
ab046dde 700 ARG_NETWORK_BRIDGE,
22b28dfd 701 ARG_NETWORK_ZONE,
f6d6bad1 702 ARG_NETWORK_VETH_EXTRA,
d7bea6b6 703 ARG_NETWORK_NAMESPACE_PATH,
6afc95b7 704 ARG_PERSONALITY,
4d9f07b4 705 ARG_VOLATILE,
ec16945e 706 ARG_TEMPLATE,
f36933fe 707 ARG_PROPERTY,
6dac160c 708 ARG_PRIVATE_USERS,
c6c8f6e2 709 ARG_KILL_SIGNAL,
f757855e 710 ARG_SETTINGS,
5f932eb9 711 ARG_CHDIR,
b53ede69 712 ARG_PIVOT_ROOT,
7336138e 713 ARG_PRIVATE_USERS_CHOWN,
6c045a99 714 ARG_PRIVATE_USERS_OWNERSHIP,
9c1e04d0 715 ARG_NOTIFY_READY,
4623e8e6 716 ARG_ROOT_HASH,
89e62e0b
LP		 717 ARG_ROOT_HASH_SIG,
718 ARG_VERITY_DATA,
960e4569 719 ARG_SYSTEM_CALL_FILTER,
bf428efb 720 ARG_RLIMIT,
3a9530e5 721 ARG_HOSTNAME,
66edd963 722 ARG_NO_NEW_PRIVILEGES,
81f345df 723 ARG_OOM_SCORE_ADJUST,
d107bb7d 724 ARG_CPU_AFFINITY,
09d423e9 725 ARG_RESOLV_CONF,
1688841f 726 ARG_TIMEZONE,
de40a303
LP		 727 ARG_CONSOLE,
728 ARG_PIPE,
729 ARG_OCI_BUNDLE,
bb068de0 730 ARG_NO_PAGER,
3652872a
LP		 731 ARG_SET_CREDENTIAL,
732 ARG_LOAD_CREDENTIAL,
2f893044 733 ARG_BIND_USER,
4a4654e0 734 ARG_SUPPRESS_SYNC,
a41fe3a2
LP		 735 };
736
88213476 737 static const struct option options[] = {
d7bea6b6
DP		 738 { "help", no_argument, NULL, 'h' },
739 { "version", no_argument, NULL, ARG_VERSION },
740 { "directory", required_argument, NULL, 'D' },
741 { "template", required_argument, NULL, ARG_TEMPLATE },
742 { "ephemeral", no_argument, NULL, 'x' },
743 { "user", required_argument, NULL, 'u' },
744 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
745 { "as-pid2", no_argument, NULL, 'a' },
746 { "boot", no_argument, NULL, 'b' },
747 { "uuid", required_argument, NULL, ARG_UUID },
748 { "read-only", no_argument, NULL, ARG_READ_ONLY },
749 { "capability", required_argument, NULL, ARG_CAPABILITY },
88fc9c9b 750 { "ambient-capability", required_argument, NULL, ARG_AMBIENT_CAPABILITY },
d7bea6b6 751 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
66edd963 752 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
d7bea6b6
DP		 753 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
754 { "bind", required_argument, NULL, ARG_BIND },
755 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
756 { "tmpfs", required_argument, NULL, ARG_TMPFS },
757 { "overlay", required_argument, NULL, ARG_OVERLAY },
758 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
de40a303 759 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
d7bea6b6 760 { "machine", required_argument, NULL, 'M' },
3a9530e5 761 { "hostname", required_argument, NULL, ARG_HOSTNAME },
d7bea6b6
DP		 762 { "slice", required_argument, NULL, 'S' },
763 { "setenv", required_argument, NULL, 'E' },
764 { "selinux-context", required_argument, NULL, 'Z' },
765 { "selinux-apifs-context", required_argument, NULL, 'L' },
766 { "quiet", no_argument, NULL, 'q' },
767 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
768 { "register", required_argument, NULL, ARG_REGISTER },
769 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
770 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
771 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
772 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
773 { "network-veth", no_argument, NULL, 'n' },
774 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
775 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
776 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
777 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
778 { "personality", required_argument, NULL, ARG_PERSONALITY },
779 { "image", required_argument, NULL, 'i' },
780 { "volatile", optional_argument, NULL, ARG_VOLATILE },
781 { "port", required_argument, NULL, 'p' },
782 { "property", required_argument, NULL, ARG_PROPERTY },
783 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
6c045a99
LP		 784 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN }, /* obsolete */
785 { "private-users-ownership",required_argument, NULL, ARG_PRIVATE_USERS_OWNERSHIP},
d7bea6b6
DP		 786 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
787 { "settings", required_argument, NULL, ARG_SETTINGS },
788 { "chdir", required_argument, NULL, ARG_CHDIR },
789 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
790 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
791 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
89e62e0b
LP		 792 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
793 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
d7bea6b6 794 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
bf428efb 795 { "rlimit", required_argument, NULL, ARG_RLIMIT },
81f345df 796 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
d107bb7d 797 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
09d423e9 798 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
1688841f 799 { "timezone", required_argument, NULL, ARG_TIMEZONE },
de40a303
LP		 800 { "console", required_argument, NULL, ARG_CONSOLE },
801 { "pipe", no_argument, NULL, ARG_PIPE },
802 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
bb068de0 803 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
3652872a
LP		 804 { "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
805 { "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
2f893044 806 { "bind-user", required_argument, NULL, ARG_BIND_USER },
4a4654e0 807 { "suppress-sync", required_argument, NULL, ARG_SUPPRESS_SYNC },
eb9da376 808 {}
88213476
LP		 809 };
810
9444b1f2 811 int c, r;
a42c8b54 812 uint64_t plus = 0, minus = 0;
f757855e 813 bool mask_all_settings = false, mask_no_settings = false;
88213476
LP		 814
815 assert(argc >= 0);
816 assert(argv);
817
de40a303 818 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
88213476
LP		 819 switch (c) {
820
821 case 'h':
37ec0fdd 822 return help();
88213476 823
acbeb427 824 case ARG_VERSION:
3f6fd1ba 825 return version();
acbeb427 826
88213476 827 case 'D':
614b022c 828 r = parse_path_argument(optarg, false, &arg_directory);
ec16945e 829 if (r < 0)
0f03c2a4 830 return r;
de40a303
LP		 831
832 arg_settings_mask |= SETTING_DIRECTORY;
ec16945e
LP		 833 break;
834
835 case ARG_TEMPLATE:
614b022c 836 r = parse_path_argument(optarg, false, &arg_template);
ec16945e 837 if (r < 0)
0f03c2a4 838 return r;
de40a303
LP		 839
840 arg_settings_mask |= SETTING_DIRECTORY;
88213476
LP		 841 break;
842
1b9e5b12 843 case 'i':
614b022c 844 r = parse_path_argument(optarg, false, &arg_image);
ec16945e 845 if (r < 0)
0f03c2a4 846 return r;
de40a303
LP		 847
848 arg_settings_mask |= SETTING_DIRECTORY;
849 break;
850
851 case ARG_OCI_BUNDLE:
614b022c 852 r = parse_path_argument(optarg, false, &arg_oci_bundle);
de40a303
LP		 853 if (r < 0)
854 return r;
855
ec16945e
LP		 856 break;
857
858 case 'x':
859 arg_ephemeral = true;
a2f577fc 860 arg_settings_mask |= SETTING_EPHEMERAL;
1b9e5b12
LP		 861 break;
862
687d0825 863 case 'u':
2fc09a9c
DM		 864 r = free_and_strdup(&arg_user, optarg);
865 if (r < 0)
7027ff61 866 return log_oom();
687d0825 867
f757855e 868 arg_settings_mask |= SETTING_USER;
687d0825
MV		 869 break;
870
22b28dfd
LP		 871 case ARG_NETWORK_ZONE: {
872 char *j;
873
b910cc72 874 j = strjoin("vz-", optarg);
22b28dfd
LP		 875 if (!j)
876 return log_oom();
877
878 if (!ifname_valid(j)) {
879 log_error("Network zone name not valid: %s", j);
880 free(j);
881 return -EINVAL;
882 }
883
df1fac6d 884 free_and_replace(arg_network_zone, j);
22b28dfd
LP		 885
886 arg_network_veth = true;
887 arg_private_network = true;
888 arg_settings_mask |= SETTING_NETWORK;
889 break;
890 }
891
ab046dde 892 case ARG_NETWORK_BRIDGE:
ef76dff2 893
baaa35ad
ZJS		 894 if (!ifname_valid(optarg))
895 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
896 "Bridge interface name not valid: %s", optarg);
ef76dff2 897
f757855e
LP		 898 r = free_and_strdup(&arg_network_bridge, optarg);
899 if (r < 0)
900 return log_oom();
ab046dde 901
4831981d 902 _fallthrough_;
0dfaa006 903 case 'n':
69c79d3c
LP		 904 arg_network_veth = true;
905 arg_private_network = true;
f757855e 906 arg_settings_mask |= SETTING_NETWORK;
69c79d3c
LP		 907 break;
908
f6d6bad1
LP		 909 case ARG_NETWORK_VETH_EXTRA:
910 r = veth_extra_parse(&arg_network_veth_extra, optarg);
911 if (r < 0)
912 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
913
914 arg_private_network = true;
915 arg_settings_mask |= SETTING_NETWORK;
916 break;
917
aa28aefe 918 case ARG_NETWORK_INTERFACE:
baaa35ad
ZJS		 919 if (!ifname_valid(optarg))
920 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
921 "Network interface name not valid: %s", optarg);
ef76dff2 922
b390f178
DDM		 923 r = test_network_interface_initialized(optarg);
924 if (r < 0)
925 return r;
926
c74e630d
LP		 927 if (strv_extend(&arg_network_interfaces, optarg) < 0)
928 return log_oom();
929
930 arg_private_network = true;
f757855e 931 arg_settings_mask |= SETTING_NETWORK;
c74e630d
LP		 932 break;
933
934 case ARG_NETWORK_MACVLAN:
ef76dff2 935
baaa35ad
ZJS		 936 if (!ifname_valid(optarg))
937 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
938 "MACVLAN network interface name not valid: %s", optarg);
ef76dff2 939
b390f178
DDM		 940 r = test_network_interface_initialized(optarg);
941 if (r < 0)
942 return r;
943
c74e630d 944 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 945 return log_oom();
946
4bbfe7ad 947 arg_private_network = true;
f757855e 948 arg_settings_mask |= SETTING_NETWORK;
4bbfe7ad
TG		 949 break;
950
951 case ARG_NETWORK_IPVLAN:
ef76dff2 952
baaa35ad
ZJS		 953 if (!ifname_valid(optarg))
954 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
955 "IPVLAN network interface name not valid: %s", optarg);
ef76dff2 956
b390f178
DDM		 957 r = test_network_interface_initialized(optarg);
958 if (r < 0)
959 return r;
960
4bbfe7ad
TG		 961 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
962 return log_oom();
963
4831981d 964 _fallthrough_;
ff01d048
LP		 965 case ARG_PRIVATE_NETWORK:
966 arg_private_network = true;
f757855e 967 arg_settings_mask |= SETTING_NETWORK;
a41fe3a2
LP		 968 break;
969
d7bea6b6 970 case ARG_NETWORK_NAMESPACE_PATH:
614b022c 971 r = parse_path_argument(optarg, false, &arg_network_namespace_path);
d7bea6b6
DP		 972 if (r < 0)
973 return r;
974
de40a303 975 arg_settings_mask |= SETTING_NETWORK;
d7bea6b6
DP		 976 break;
977
0f0dbc46 978 case 'b':
baaa35ad
ZJS		 979 if (arg_start_mode == START_PID2)
980 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
981 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 982
983 arg_start_mode = START_BOOT;
984 arg_settings_mask |= SETTING_START_MODE;
985 break;
986
987 case 'a':
baaa35ad
ZJS		 988 if (arg_start_mode == START_BOOT)
989 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
990 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 991
992 arg_start_mode = START_PID2;
993 arg_settings_mask |= SETTING_START_MODE;
0f0dbc46
LP		 994 break;
995
144f0fc0 996 case ARG_UUID:
9444b1f2 997 r = sd_id128_from_string(optarg, &arg_uuid);
317feb4d
LP		 998 if (r < 0)
999 return log_error_errno(r, "Invalid UUID: %s", optarg);
1000
baaa35ad
ZJS		 1001 if (sd_id128_is_null(arg_uuid))
1002 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1003 "Machine UUID may not be all zeroes.");
f757855e
LP		 1004
1005 arg_settings_mask |= SETTING_MACHINE_ID;
9444b1f2 1006 break;
aa96c6cb 1007
43c3fb46
LP		 1008 case 'S': {
1009 _cleanup_free_ char *mangled = NULL;
1010
1011 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
de40a303
LP		 1012 if (r < 0)
1013 return log_oom();
1014
43c3fb46 1015 free_and_replace(arg_slice, mangled);
de40a303 1016 arg_settings_mask |= SETTING_SLICE;
144f0fc0 1017 break;
43c3fb46 1018 }
144f0fc0 1019
7027ff61 1020 case 'M':
c1521918 1021 if (isempty(optarg))
97b11eed 1022 arg_machine = mfree(arg_machine);
c1521918 1023 else {
52ef5dd7 1024 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1025 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1026 "Invalid machine name: %s", optarg);
7027ff61 1027
0c3c4284
LP		 1028 r = free_and_strdup(&arg_machine, optarg);
1029 if (r < 0)
eb91eb18 1030 return log_oom();
eb91eb18 1031 }
9ce6d1b3 1032 break;
7027ff61 1033
3a9530e5
LP		 1034 case ARG_HOSTNAME:
1035 if (isempty(optarg))
1036 arg_hostname = mfree(arg_hostname);
1037 else {
52ef5dd7 1038 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1039 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1040 "Invalid hostname: %s", optarg);
3a9530e5
LP		 1041
1042 r = free_and_strdup(&arg_hostname, optarg);
1043 if (r < 0)
1044 return log_oom();
1045 }
1046
1047 arg_settings_mask |= SETTING_HOSTNAME;
1048 break;
1049
82adf6af
LP		 1050 case 'Z':
1051 arg_selinux_context = optarg;
a8828ed9
DW		 1052 break;
1053
82adf6af
LP		 1054 case 'L':
1055 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 1056 break;
1057
bc2f673e
LP		 1058 case ARG_READ_ONLY:
1059 arg_read_only = true;
f757855e 1060 arg_settings_mask |= SETTING_READ_ONLY;
bc2f673e
LP		 1061 break;
1062
88fc9c9b
TH		 1063 case ARG_AMBIENT_CAPABILITY: {
1064 uint64_t m;
1065 r = parse_capability_spec(optarg, &m);
1066 if (r <= 0)
1067 return r;
1068 arg_caps_ambient |= m;
1069 arg_settings_mask |= SETTING_CAPABILITY;
1070 break;
1071 }
420c7379
LP		 1072 case ARG_CAPABILITY:
1073 case ARG_DROP_CAPABILITY: {
8a99bd0c
ZJS		 1074 uint64_t m;
1075 r = parse_capability_spec(optarg, &m);
1076 if (r <= 0)
1077 return r;
5076f0cc 1078
8a99bd0c
ZJS		 1079 if (c == ARG_CAPABILITY)
1080 plus |= m;
1081 else
1082 minus |= m;
f757855e 1083 arg_settings_mask |= SETTING_CAPABILITY;
5076f0cc
LP		 1084 break;
1085 }
66edd963
LP		 1086 case ARG_NO_NEW_PRIVILEGES:
1087 r = parse_boolean(optarg);
1088 if (r < 0)
1089 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1090
1091 arg_no_new_privileges = r;
1092 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1093 break;
1094
57fb9fb5
LP		 1095 case 'j':
1096 arg_link_journal = LINK_GUEST;
574edc90 1097 arg_link_journal_try = true;
4e1d6aa9 1098 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1099 break;
1100
1101 case ARG_LINK_JOURNAL:
4e1d6aa9 1102 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
c6147113
LP		 1103 if (r < 0)
1104 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
57fb9fb5 1105
4e1d6aa9 1106 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1107 break;
1108
17fe0523 1109 case ARG_BIND:
f757855e
LP		 1110 case ARG_BIND_RO:
1111 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1112 if (r < 0)
1113 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
17fe0523 1114
f757855e 1115 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
17fe0523 1116 break;
06c17c39 1117
f757855e
LP		 1118 case ARG_TMPFS:
1119 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1120 if (r < 0)
1121 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
5a8af538 1122
f757855e 1123 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
5a8af538 1124 break;
5a8af538
LP		 1125
1126 case ARG_OVERLAY:
ad85779a
LP		 1127 case ARG_OVERLAY_RO:
1128 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1129 if (r == -EADDRNOTAVAIL)
1130 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1131 if (r < 0)
1132 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
06c17c39 1133
f757855e 1134 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
06c17c39 1135 break;
06c17c39 1136
de40a303
LP		 1137 case ARG_INACCESSIBLE:
1138 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1139 if (r < 0)
1140 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1141
1142 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1143 break;
1144
0d2a0179
ZJS		 1145 case 'E':
1146 r = strv_env_replace_strdup_passthrough(&arg_setenv, optarg);
aaf057c4 1147 if (r < 0)
0d2a0179 1148 return log_error_errno(r, "Cannot assign environment variable %s: %m", optarg);
f4889f65 1149
f757855e 1150 arg_settings_mask |= SETTING_ENVIRONMENT;
f4889f65 1151 break;
f4889f65 1152
284c0b91
LP		 1153 case 'q':
1154 arg_quiet = true;
1155 break;
1156
8a96d94e 1157 case ARG_SHARE_SYSTEM:
a6b5216c 1158 /* We don't officially support this anymore, except for compat reasons. People should use the
0c582db0 1159 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
63d1c29f 1160 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
0c582db0 1161 arg_clone_ns_flags = 0;
8a96d94e
LP		 1162 break;
1163
eb91eb18
LP		 1164 case ARG_REGISTER:
1165 r = parse_boolean(optarg);
1166 if (r < 0) {
1167 log_error("Failed to parse --register= argument: %s", optarg);
1168 return r;
1169 }
1170
1171 arg_register = r;
1172 break;
1173
89f7c846
LP		 1174 case ARG_KEEP_UNIT:
1175 arg_keep_unit = true;
1176 break;
1177
6afc95b7
LP		 1178 case ARG_PERSONALITY:
1179
ac45f971 1180 arg_personality = personality_from_string(optarg);
baaa35ad
ZJS		 1181 if (arg_personality == PERSONALITY_INVALID)
1182 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1183 "Unknown or unsupported personality '%s'.", optarg);
6afc95b7 1184
f757855e 1185 arg_settings_mask |= SETTING_PERSONALITY;
6afc95b7
LP		 1186 break;
1187
4d9f07b4
LP		 1188 case ARG_VOLATILE:
1189
1190 if (!optarg)
f757855e 1191 arg_volatile_mode = VOLATILE_YES;
5c828e66
LP		 1192 else if (streq(optarg, "help")) {
1193 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1194 return 0;
1195 } else {
f757855e 1196 VolatileMode m;
4d9f07b4 1197
f757855e 1198 m = volatile_mode_from_string(optarg);
baaa35ad
ZJS		 1199 if (m < 0)
1200 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1201 "Failed to parse --volatile= argument: %s", optarg);
1202 else
f757855e 1203 arg_volatile_mode = m;
6d0b55c2
LP		 1204 }
1205
f757855e
LP		 1206 arg_settings_mask |= SETTING_VOLATILE_MODE;
1207 break;
6d0b55c2 1208
f757855e
LP		 1209 case 'p':
1210 r = expose_port_parse(&arg_expose_ports, optarg);
1211 if (r == -EEXIST)
1212 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1213 if (r < 0)
1214 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
6d0b55c2 1215
f757855e 1216 arg_settings_mask |= SETTING_EXPOSE_PORTS;
6d0b55c2 1217 break;
6d0b55c2 1218
f36933fe
LP		 1219 case ARG_PROPERTY:
1220 if (strv_extend(&arg_property, optarg) < 0)
1221 return log_oom();
1222
1223 break;
1224
ae209204 1225 case ARG_PRIVATE_USERS: {
33eac552 1226 int boolean;
0de7acce 1227
ae209204
ZJS		 1228 if (!optarg)
1229 boolean = true;
1230 else if (!in_charset(optarg, DIGITS))
1231 /* do *not* parse numbers as booleans */
1232 boolean = parse_boolean(optarg);
33eac552
LP		 1233 else
1234 boolean = -1;
ae209204 1235
33eac552 1236 if (boolean == 0) {
0de7acce
LP		 1237 /* no: User namespacing off */
1238 arg_userns_mode = USER_NAMESPACE_NO;
1239 arg_uid_shift = UID_INVALID;
1240 arg_uid_range = UINT32_C(0x10000);
33eac552 1241 } else if (boolean > 0) {
0de7acce
LP		 1242 /* yes: User namespacing on, UID range is read from root dir */
1243 arg_userns_mode = USER_NAMESPACE_FIXED;
1244 arg_uid_shift = UID_INVALID;
1245 arg_uid_range = UINT32_C(0x10000);
1246 } else if (streq(optarg, "pick")) {
1247 /* pick: User namespacing on, UID range is picked randomly */
6c045a99
LP		 1248 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1249 * implied by USER_NAMESPACE_PICK
33eac552 1250 * further down. */
0de7acce
LP		 1251 arg_uid_shift = UID_INVALID;
1252 arg_uid_range = UINT32_C(0x10000);
33eac552
LP		 1253
1254 } else if (streq(optarg, "identity")) {
6c2d70ce 1255 /* identity: User namespaces on, UID range is map the 0…0xFFFF range to
33eac552
LP		 1256 * itself, i.e. we don't actually map anything, but do take benefit of
1257 * isolation of capability sets. */
1258 arg_userns_mode = USER_NAMESPACE_FIXED;
1259 arg_uid_shift = 0;
1260 arg_uid_range = UINT32_C(0x10000);
0de7acce 1261 } else {
6c2058b3 1262 _cleanup_free_ char *buffer = NULL;
6dac160c
LP		 1263 const char *range, *shift;
1264
0de7acce
LP		 1265 /* anything else: User namespacing on, UID range is explicitly configured */
1266
6dac160c
LP		 1267 range = strchr(optarg, ':');
1268 if (range) {
6c2058b3
ZJS		 1269 buffer = strndup(optarg, range - optarg);
1270 if (!buffer)
1271 return log_oom();
1272 shift = buffer;
6dac160c
LP		 1273
1274 range++;
bfd292ec
ZJS		 1275 r = safe_atou32(range, &arg_uid_range);
1276 if (r < 0)
be715731 1277 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
6dac160c
LP		 1278 } else
1279 shift = optarg;
1280
be715731
ZJS		 1281 r = parse_uid(shift, &arg_uid_shift);
1282 if (r < 0)
1283 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
0de7acce
LP		 1284
1285 arg_userns_mode = USER_NAMESPACE_FIXED;
6dac160c 1286
58e13de5
LP		 1287 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
1288 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID range cannot be empty or go beyond " UID_FMT ".", UID_INVALID);
1289 }
be715731 1290
0de7acce 1291 arg_settings_mask |= SETTING_USERNS;
6dac160c 1292 break;
ae209204 1293 }
6dac160c 1294
0de7acce 1295 case 'U':
ccabee0d 1296 if (userns_supported()) {
6c045a99
LP		 1297 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1298 * implied by USER_NAMESPACE_PICK
33eac552 1299 * further down. */
ccabee0d
LP		 1300 arg_uid_shift = UID_INVALID;
1301 arg_uid_range = UINT32_C(0x10000);
1302
1303 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1304 }
1305
7336138e
LP		 1306 break;
1307
0de7acce 1308 case ARG_PRIVATE_USERS_CHOWN:
6c045a99
LP		 1309 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
1310
1311 arg_settings_mask |= SETTING_USERNS;
1312 break;
1313
1314 case ARG_PRIVATE_USERS_OWNERSHIP:
1315 if (streq(optarg, "help")) {
1316 DUMP_STRING_TABLE(user_namespace_ownership, UserNamespaceOwnership, _USER_NAMESPACE_OWNERSHIP_MAX);
1317 return 0;
1318 }
1319
1320 arg_userns_ownership = user_namespace_ownership_from_string(optarg);
1321 if (arg_userns_ownership < 0)
1322 return log_error_errno(arg_userns_ownership, "Cannot parse --user-namespace-ownership= value: %s", optarg);
0de7acce
LP		 1323
1324 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1325 break;
1326
c6c8f6e2 1327 case ARG_KILL_SIGNAL:
5c828e66
LP		 1328 if (streq(optarg, "help")) {
1329 DUMP_STRING_TABLE(signal, int, _NSIG);
1330 return 0;
1331 }
1332
29a3db75 1333 arg_kill_signal = signal_from_string(optarg);
baaa35ad 1334 if (arg_kill_signal < 0)
7211c853 1335 return log_error_errno(arg_kill_signal, "Cannot parse signal: %s", optarg);
c6c8f6e2 1336
f757855e
LP		 1337 arg_settings_mask |= SETTING_KILL_SIGNAL;
1338 break;
1339
1340 case ARG_SETTINGS:
1341
1342 /* no → do not read files
1343 * yes → read files, do not override cmdline, trust only subset
1344 * override → read files, override cmdline, trust only subset
1345 * trusted → read files, do not override cmdline, trust all
1346 */
1347
1348 r = parse_boolean(optarg);
1349 if (r < 0) {
1350 if (streq(optarg, "trusted")) {
1351 mask_all_settings = false;
1352 mask_no_settings = false;
1353 arg_settings_trusted = true;
1354
1355 } else if (streq(optarg, "override")) {
1356 mask_all_settings = false;
1357 mask_no_settings = true;
1358 arg_settings_trusted = -1;
1359 } else
1360 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1361 } else if (r > 0) {
1362 /* yes */
1363 mask_all_settings = false;
1364 mask_no_settings = false;
1365 arg_settings_trusted = -1;
1366 } else {
1367 /* no */
1368 mask_all_settings = true;
1369 mask_no_settings = false;
1370 arg_settings_trusted = false;
1371 }
1372
c6c8f6e2
LP		 1373 break;
1374
5f932eb9 1375 case ARG_CHDIR:
baaa35ad
ZJS		 1376 if (!path_is_absolute(optarg))
1377 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1378 "Working directory %s is not an absolute path.", optarg);
5f932eb9
LP		 1379
1380 r = free_and_strdup(&arg_chdir, optarg);
1381 if (r < 0)
1382 return log_oom();
1383
1384 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1385 break;
1386
b53ede69
PW		 1387 case ARG_PIVOT_ROOT:
1388 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1389 if (r < 0)
1390 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1391
1392 arg_settings_mask |= SETTING_PIVOT_ROOT;
1393 break;
1394
9c1e04d0
AP		 1395 case ARG_NOTIFY_READY:
1396 r = parse_boolean(optarg);
baaa35ad
ZJS		 1397 if (r < 0)
1398 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1399 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
9c1e04d0
AP		 1400 arg_notify_ready = r;
1401 arg_settings_mask |= SETTING_NOTIFY_READY;
1402 break;
1403
4623e8e6 1404 case ARG_ROOT_HASH: {
89e62e0b 1405 _cleanup_free_ void *k = NULL;
4623e8e6
LP		 1406 size_t l;
1407
1408 r = unhexmem(optarg, strlen(optarg), &k, &l);
1409 if (r < 0)
1410 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
89e62e0b 1411 if (l < sizeof(sd_id128_t))
c6147113 1412 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
4623e8e6 1413
89e62e0b
LP		 1414 free_and_replace(arg_verity_settings.root_hash, k);
1415 arg_verity_settings.root_hash_size = l;
4623e8e6
LP		 1416 break;
1417 }
1418
c2923fdc
LB		 1419 case ARG_ROOT_HASH_SIG: {
1420 char *value;
89e62e0b
LP		 1421 size_t l;
1422 void *p;
c2923fdc
LB		 1423
1424 if ((value = startswith(optarg, "base64:"))) {
c2923fdc
LB		 1425 r = unbase64mem(value, strlen(value), &p, &l);
1426 if (r < 0)
1427 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1428
c2923fdc 1429 } else {
89e62e0b 1430 r = read_full_file(optarg, (char**) &p, &l);
c2923fdc 1431 if (r < 0)
89e62e0b 1432 return log_error_errno(r, "Failed parse root hash signature file '%s': %m", optarg);
c2923fdc
LB		 1433 }
1434
89e62e0b
LP		 1435 free_and_replace(arg_verity_settings.root_hash_sig, p);
1436 arg_verity_settings.root_hash_sig_size = l;
c2923fdc
LB		 1437 break;
1438 }
1439
89e62e0b 1440 case ARG_VERITY_DATA:
614b022c 1441 r = parse_path_argument(optarg, false, &arg_verity_settings.data_path);
89e62e0b
LP		 1442 if (r < 0)
1443 return r;
1444 break;
1445
960e4569
LP		 1446 case ARG_SYSTEM_CALL_FILTER: {
1447 bool negative;
1448 const char *items;
1449
1450 negative = optarg[0] == '~';
1451 items = negative ? optarg + 1 : optarg;
1452
1453 for (;;) {
1454 _cleanup_free_ char *word = NULL;
1455
1456 r = extract_first_word(&items, &word, NULL, 0);
1457 if (r == 0)
1458 break;
1459 if (r == -ENOMEM)
1460 return log_oom();
1461 if (r < 0)
1462 return log_error_errno(r, "Failed to parse system call filter: %m");
1463
1464 if (negative)
6b000af4 1465 r = strv_extend(&arg_syscall_deny_list, word);
960e4569 1466 else
6b000af4 1467 r = strv_extend(&arg_syscall_allow_list, word);
960e4569
LP		 1468 if (r < 0)
1469 return log_oom();
1470 }
1471
1472 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1473 break;
1474 }
1475
bf428efb
LP		 1476 case ARG_RLIMIT: {
1477 const char *eq;
622ecfa8 1478 _cleanup_free_ char *name = NULL;
bf428efb
LP		 1479 int rl;
1480
5c828e66
LP		 1481 if (streq(optarg, "help")) {
1482 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1483 return 0;
1484 }
1485
bf428efb 1486 eq = strchr(optarg, '=');
baaa35ad
ZJS		 1487 if (!eq)
1488 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1489 "--rlimit= expects an '=' assignment.");
bf428efb
LP		 1490
1491 name = strndup(optarg, eq - optarg);
1492 if (!name)
1493 return log_oom();
1494
1495 rl = rlimit_from_string_harder(name);
baaa35ad 1496 if (rl < 0)
7211c853 1497 return log_error_errno(rl, "Unknown resource limit: %s", name);
bf428efb
LP		 1498
1499 if (!arg_rlimit[rl]) {
1500 arg_rlimit[rl] = new0(struct rlimit, 1);
1501 if (!arg_rlimit[rl])
1502 return log_oom();
1503 }
1504
1505 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1506 if (r < 0)
1507 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1508
1509 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1510 break;
1511 }
1512
81f345df
LP		 1513 case ARG_OOM_SCORE_ADJUST:
1514 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1515 if (r < 0)
1516 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1517
1518 arg_oom_score_adjust_set = true;
1519 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1520 break;
1521
d107bb7d 1522 case ARG_CPU_AFFINITY: {
0985c7c4 1523 CPUSet cpuset;
d107bb7d
LP		 1524
1525 r = parse_cpu_set(optarg, &cpuset);
1526 if (r < 0)
0985c7c4 1527 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
d107bb7d 1528
0985c7c4
ZJS		 1529 cpu_set_reset(&arg_cpu_set);
1530 arg_cpu_set = cpuset;
d107bb7d
LP		 1531 arg_settings_mask |= SETTING_CPU_AFFINITY;
1532 break;
1533 }
1534
09d423e9
LP		 1535 case ARG_RESOLV_CONF:
1536 if (streq(optarg, "help")) {
1537 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1538 return 0;
1539 }
1540
1541 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
baaa35ad 1542 if (arg_resolv_conf < 0)
7211c853 1543 return log_error_errno(arg_resolv_conf,
baaa35ad 1544 "Failed to parse /etc/resolv.conf mode: %s", optarg);
09d423e9
LP		 1545
1546 arg_settings_mask |= SETTING_RESOLV_CONF;
1547 break;
1548
1688841f
LP		 1549 case ARG_TIMEZONE:
1550 if (streq(optarg, "help")) {
1551 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1552 return 0;
1553 }
1554
1555 arg_timezone = timezone_mode_from_string(optarg);
baaa35ad 1556 if (arg_timezone < 0)
7211c853 1557 return log_error_errno(arg_timezone,
baaa35ad 1558 "Failed to parse /etc/localtime mode: %s", optarg);
1688841f
LP		 1559
1560 arg_settings_mask |= SETTING_TIMEZONE;
1561 break;
1562
de40a303 1563 case ARG_CONSOLE:
dce66ffe
ZJS		 1564 r = handle_arg_console(optarg);
1565 if (r <= 0)
1566 return r;
de40a303
LP		 1567 break;
1568
1569 case 'P':
1570 case ARG_PIPE:
dce66ffe
ZJS		 1571 r = handle_arg_console("pipe");
1572 if (r <= 0)
1573 return r;
de40a303
LP		 1574 break;
1575
bb068de0
ZJS		 1576 case ARG_NO_PAGER:
1577 arg_pager_flags |= PAGER_DISABLE;
1578 break;
1579
3652872a
LP		 1580 case ARG_SET_CREDENTIAL: {
1581 _cleanup_free_ char *word = NULL, *data = NULL;
1582 const char *p = optarg;
1583 Credential *a;
e437538f 1584 ssize_t l;
3652872a
LP		 1585
1586 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1587 if (r == -ENOMEM)
1588 return log_oom();
1589 if (r < 0)
1590 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1591 if (r == 0 || !p)
1592 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1593
1594 if (!credential_name_valid(word))
1595 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1596
12d729b2 1597 for (size_t i = 0; i < arg_n_credentials; i++)
3652872a
LP		 1598 if (streq(arg_credentials[i].id, word))
1599 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1600
1601 l = cunescape(p, UNESCAPE_ACCEPT_NUL, &data);
1602 if (l < 0)
1603 return log_error_errno(l, "Failed to unescape credential data: %s", p);
1604
1605 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1606 if (!a)
1607 return log_oom();
1608
1609 a[arg_n_credentials++] = (Credential) {
1610 .id = TAKE_PTR(word),
1611 .data = TAKE_PTR(data),
1612 .size = l,
1613 };
1614
1615 arg_credentials = a;
1616
1617 arg_settings_mask |= SETTING_CREDENTIALS;
1618 break;
1619 }
1620
1621 case ARG_LOAD_CREDENTIAL: {
1622 ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
1623 _cleanup_(erase_and_freep) char *data = NULL;
1624 _cleanup_free_ char *word = NULL, *j = NULL;
1625 const char *p = optarg;
1626 Credential *a;
1627 size_t size, i;
1628
1629 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1630 if (r == -ENOMEM)
1631 return log_oom();
1632 if (r < 0)
c941b650 1633 return log_error_errno(r, "Failed to parse --load-credential= parameter: %m");
3652872a 1634 if (r == 0 || !p)
c941b650 1635 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --load-credential=: %s", optarg);
3652872a
LP		 1636
1637 if (!credential_name_valid(word))
1638 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1639
1640 for (i = 0; i < arg_n_credentials; i++)
1641 if (streq(arg_credentials[i].id, word))
1642 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1643
1644 if (path_is_absolute(p))
1645 flags |= READ_FULL_FILE_CONNECT_SOCKET;
1646 else {
1647 const char *e;
1648
786d19fd
LP		 1649 r = get_credentials_dir(&e);
1650 if (r < 0)
1651 return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
3652872a
LP		 1652
1653 j = path_join(e, p);
1654 if (!j)
1655 return log_oom();
1656 }
1657
986311c2
LP		 1658 r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
1659 flags,
1660 NULL,
1661 &data, &size);
3652872a
LP		 1662 if (r < 0)
1663 return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
1664
1665 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1666 if (!a)
1667 return log_oom();
1668
1669 a[arg_n_credentials++] = (Credential) {
1670 .id = TAKE_PTR(word),
1671 .data = TAKE_PTR(data),
1672 .size = size,
1673 };
1674
1675 arg_credentials = a;
1676
1677 arg_settings_mask |= SETTING_CREDENTIALS;
1678 break;
1679 }
1680
2f893044
LP		 1681 case ARG_BIND_USER:
1682 if (!valid_user_group_name(optarg, 0))
1683 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid user name to bind: %s", optarg);
1684
1685 if (strv_extend(&arg_bind_user, optarg) < 0)
1686 return log_oom();
1687
1688 arg_settings_mask |= SETTING_BIND_USER;
1689 break;
1690
4a4654e0
LP		 1691 case ARG_SUPPRESS_SYNC:
1692 r = parse_boolean_argument("--suppress-sync=", optarg, &arg_suppress_sync);
1693 if (r < 0)
1694 return r;
1695
1696 arg_settings_mask |= SETTING_SUPPRESS_SYNC;
1697 break;
1698
88213476
LP		 1699 case '?':
1700 return -EINVAL;
1701
1702 default:
04499a70 1703 assert_not_reached();
88213476 1704 }
88213476 1705
60f1ec13
LP		 1706 if (argc > optind) {
1707 strv_free(arg_parameters);
1708 arg_parameters = strv_copy(argv + optind);
1709 if (!arg_parameters)
1710 return log_oom();
d7bea6b6 1711
60f1ec13
LP		 1712 arg_settings_mask |= SETTING_START_MODE;
1713 }
1714
1715 if (arg_ephemeral && arg_template && !arg_directory)
1716 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1717 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1718 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1719 * --directory=". */
1720 arg_directory = TAKE_PTR(arg_template);
1721
2642d22a
DDM		 1722 arg_caps_retain |= plus;
1723 arg_caps_retain |= arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0;
1724
1725 /* If we're not unsharing the network namespace and are unsharing the user namespace, we won't have
1726 * permissions to bind ports in the container, so let's drop the CAP_NET_BIND_SERVICE capability to
1727 * indicate that. */
1728 if (!arg_private_network && arg_userns_mode != USER_NAMESPACE_NO && arg_uid_shift > 0)
1729 arg_caps_retain &= ~(UINT64_C(1) << CAP_NET_BIND_SERVICE);
1730
1731 arg_caps_retain &= ~minus;
60f1ec13 1732
de40a303 1733 /* Make sure to parse environment before we reset the settings mask below */
49048684
ZJS		 1734 r = parse_environment();
1735 if (r < 0)
1736 return r;
de40a303 1737
60f1ec13
LP		 1738 /* Load all settings from .nspawn files */
1739 if (mask_no_settings)
1740 arg_settings_mask = 0;
1741
1742 /* Don't load any settings from .nspawn files */
1743 if (mask_all_settings)
1744 arg_settings_mask = _SETTINGS_MASK_ALL;
1745
1746 return 1;
1747}
1748
1749static int verify_arguments(void) {
1750 int r;
a6b5216c 1751
75b0d8b8
ZJS		 1752 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1753 /* If we are running the stub init in the container, we don't need to look at what the init
1754 * in the container supports, because we are not using it. Let's immediately pick the right
1755 * setting based on the host system configuration.
1756 *
1757 * We only do this, if the user didn't use an environment variable to override the detection.
1758 */
1759
1760 r = cg_all_unified();
1761 if (r < 0)
1762 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1763 if (r > 0)
1764 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1765 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1766 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1767 else
1768 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1769 }
1770
4f086aab
SU		 1771 if (arg_userns_mode != USER_NAMESPACE_NO)
1772 arg_mount_settings |= MOUNT_USE_USERNS;
1773
1774 if (arg_private_network)
1775 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1776
48a8d337
LB		 1777 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1778 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
eb91eb18 1779 arg_register = false;
baaa35ad 1780 if (arg_start_mode != START_PID1)
60f1ec13 1781 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
0c582db0 1782 }
eb91eb18 1783
6c045a99
LP		 1784 if (arg_userns_ownership < 0)
1785 arg_userns_ownership =
f61c7f88 1786 arg_userns_mode == USER_NAMESPACE_PICK ? USER_NAMESPACE_OWNERSHIP_AUTO :
6c045a99 1787 USER_NAMESPACE_OWNERSHIP_OFF;
0e7ac751 1788
60f1ec13
LP		 1789 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1790 arg_kill_signal = SIGRTMIN+3;
1791
e5a4bb0d
LP		 1792 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1793 arg_read_only = true;
1794
2436ea76
DDM		 1795 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1796 arg_read_only = true;
1797
baaa35ad 1798 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
8d9c2bca
AJ		 1799 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1800 * The latter is not technically a user session, but we don't need to labour the point. */
60f1ec13 1801 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
89f7c846 1802
baaa35ad 1803 if (arg_directory && arg_image)
60f1ec13 1804 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1b9e5b12 1805
baaa35ad 1806 if (arg_template && arg_image)
60f1ec13 1807 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
8cd328d8 1808
baaa35ad 1809 if (arg_template && !(arg_directory || arg_machine))
60f1ec13 1810 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
ec16945e 1811
baaa35ad 1812 if (arg_ephemeral && arg_template)
60f1ec13 1813 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
ec16945e 1814
baaa35ad 1815 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
60f1ec13 1816 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
df9a75e4 1817
baaa35ad 1818 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
60f1ec13 1819 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
7336138e 1820
6c045a99 1821 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_read_only)
de40a303 1822 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
6c045a99 1823 "--read-only and --private-users-ownership=chown may not be combined.");
f757855e 1824
6c045a99
LP		 1825 /* We don't support --private-users-ownership=chown together with any of the volatile modes since we
1826 * couldn't change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a
1827 * massive copy-up (in case of overlay) making the entire exercise pointless. */
1828 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_volatile_mode != VOLATILE_NO)
1829 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-ownership=chown may not be combined.");
e5a4bb0d 1830
679ecd36
SZ		 1831 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1832 * we need to error out, to avoid conflicts between different network options. */
60f1ec13
LP		 1833 if (arg_network_namespace_path &&
1834 (arg_network_interfaces || arg_network_macvlan ||
1835 arg_network_ipvlan || arg_network_veth_extra ||
1836 arg_network_bridge || arg_network_zone ||
679ecd36 1837 arg_network_veth))
de40a303 1838 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
86c0dd4a 1839
60f1ec13 1840 if (arg_network_bridge && arg_network_zone)
de40a303
LP		 1841 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1842 "--network-bridge= and --network-zone= may not be combined.");
f757855e 1843
baaa35ad 1844 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
60f1ec13 1845 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
4f086aab 1846
baaa35ad 1847 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
60f1ec13 1848 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
f757855e 1849
baaa35ad 1850 if (arg_expose_ports && !arg_private_network)
60f1ec13 1851 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
6d0b55c2 1852
88fc9c9b 1853 if (arg_caps_ambient) {
f5fbe71d 1854 if (arg_caps_ambient == UINT64_MAX)
88fc9c9b
TH		 1855 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= does not support the value all.");
1856
1857 if ((arg_caps_ambient & arg_caps_retain) != arg_caps_ambient)
1858 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not fully covered by Capability= setting.");
1859
1860 if (arg_start_mode == START_BOOT)
1861 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not useful for boot mode.");
1862 }
1863
2f893044
LP		 1864 if (arg_userns_mode == USER_NAMESPACE_NO && !strv_isempty(arg_bind_user))
1865 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--bind-user= requires --private-users");
1866
1867 /* Drop duplicate --bind-user= entries */
1868 strv_uniq(arg_bind_user);
1869
60f1ec13
LP		 1870 r = custom_mount_check_all();
1871 if (r < 0)
1872 return r;
c6c8f6e2 1873
f757855e 1874 return 0;
88213476
LP		 1875}
1876
91181e07 1877int userns_lchown(const char *p, uid_t uid, gid_t gid) {
03cfe0d5
LP		 1878 assert(p);
1879
0de7acce 1880 if (arg_userns_mode == USER_NAMESPACE_NO)
03cfe0d5
LP		 1881 return 0;
1882
1883 if (uid == UID_INVALID && gid == GID_INVALID)
1884 return 0;
1885
1886 if (uid != UID_INVALID) {
1887 uid += arg_uid_shift;
1888
1889 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1890 return -EOVERFLOW;
1891 }
1892
1893 if (gid != GID_INVALID) {
1894 gid += (gid_t) arg_uid_shift;
1895
1896 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1897 return -EOVERFLOW;
1898 }
1899
7c248223 1900 return RET_NERRNO(lchown(p, uid, gid));
b12afc8c
LP		 1901}
1902
91181e07 1903int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
03cfe0d5 1904 const char *q;
dae8b82e 1905 int r;
03cfe0d5
LP		 1906
1907 q = prefix_roota(root, path);
3f692e2e 1908 r = RET_NERRNO(mkdir(q, mode));
dae8b82e
ZJS		 1909 if (r == -EEXIST)
1910 return 0;
1911 if (r < 0)
1912 return r;
03cfe0d5
LP		 1913
1914 return userns_lchown(q, uid, gid);
1915}
1916
1688841f 1917static const char *timezone_from_path(const char *path) {
da9fc98d
LP		 1918 return PATH_STARTSWITH_SET(
1919 path,
1920 "../usr/share/zoneinfo/",
1921 "/usr/share/zoneinfo/");
1688841f
LP		 1922}
1923
83205269
LP		 1924static bool etc_writable(void) {
1925 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1926}
1927
e58a1277 1928static int setup_timezone(const char *dest) {
1688841f
LP		 1929 _cleanup_free_ char *p = NULL, *etc = NULL;
1930 const char *where, *check;
1931 TimezoneMode m;
d4036145 1932 int r;
f8440af5 1933
e58a1277
LP		 1934 assert(dest);
1935
1688841f 1936 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1688841f
LP		 1937 r = readlink_malloc("/etc/localtime", &p);
1938 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
83205269 1939 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1688841f 1940 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
83205269 1941 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1688841f
LP		 1942 else if (r < 0) {
1943 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1944 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1945 * file.
1946 *
1947 * Example:
1948 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1949 */
1950 return 0;
1951 } else if (arg_timezone == TIMEZONE_AUTO)
83205269 1952 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1688841f
LP		 1953 else
1954 m = arg_timezone;
1955 } else
1956 m = arg_timezone;
1957
1958 if (m == TIMEZONE_OFF)
1959 return 0;
1960
f461a28d 1961 r = chase("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
d4036145 1962 if (r < 0) {
1688841f 1963 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
d4036145
LP		 1964 return 0;
1965 }
1966
1688841f
LP		 1967 where = strjoina(etc, "/localtime");
1968
1969 switch (m) {
1970
1971 case TIMEZONE_DELETE:
1972 if (unlink(where) < 0)
1973 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1974
d4036145 1975 return 0;
d4036145 1976
1688841f
LP		 1977 case TIMEZONE_SYMLINK: {
1978 _cleanup_free_ char *q = NULL;
1979 const char *z, *what;
4d1c38b8 1980
1688841f
LP		 1981 z = timezone_from_path(p);
1982 if (!z) {
1983 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
d4036145 1984 return 0;
1688841f 1985 }
d4036145 1986
1688841f
LP		 1987 r = readlink_malloc(where, &q);
1988 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1989 return 0; /* Already pointing to the right place? Then do nothing .. */
1990
1991 check = strjoina(dest, "/usr/share/zoneinfo/", z);
f461a28d 1992 r = chase(check, dest, 0, NULL, NULL);
1688841f
LP		 1993 if (r < 0)
1994 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1995 else {
1996 if (unlink(where) < 0 && errno != ENOENT) {
1997 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1998 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1999 return 0;
2000 }
2001
2002 what = strjoina("../usr/share/zoneinfo/", z);
2003 if (symlink(what, where) < 0) {
2004 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
2005 errno, "Failed to correct timezone of container, ignoring: %m");
2006 return 0;
2007 }
2008
2009 break;
2010 }
2011
2012 _fallthrough_;
d4036145 2013 }
68fb0892 2014
1688841f
LP		 2015 case TIMEZONE_BIND: {
2016 _cleanup_free_ char *resolved = NULL;
2017 int found;
2018
f461a28d 2019 found = chase(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
1688841f
LP		 2020 if (found < 0) {
2021 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
2022 return 0;
2023 }
2024
2025 if (found == 0) /* missing? */
2026 (void) touch(resolved);
2027
511a8cfe 2028 r = mount_nofollow_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
1688841f 2029 if (r >= 0)
511a8cfe 2030 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
1688841f
LP		 2031
2032 _fallthrough_;
79d80fc1 2033 }
4d9f07b4 2034
1688841f
LP		 2035 case TIMEZONE_COPY:
2036 /* If mounting failed, try to copy */
7c2f5495 2037 r = copy_file_atomic("/etc/localtime", where, 0644, COPY_REFLINK|COPY_REPLACE);
1688841f
LP		 2038 if (r < 0) {
2039 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2040 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
2041 return 0;
2042 }
2043
2044 break;
2045
2046 default:
04499a70 2047 assert_not_reached();
d4036145 2048 }
e58a1277 2049
1688841f 2050 /* Fix permissions of the symlink or file copy we just created */
03cfe0d5
LP		 2051 r = userns_lchown(where, 0, 0);
2052 if (r < 0)
1688841f 2053 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
03cfe0d5 2054
e58a1277 2055 return 0;
88213476
LP		 2056}
2057
09d423e9
LP		 2058static int have_resolv_conf(const char *path) {
2059 assert(path);
2060
2061 if (access(path, F_OK) < 0) {
2062 if (errno == ENOENT)
2063 return 0;
2064
2065 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
2066 }
2067
2068 return 1;
2069}
2070
7357272e 2071static int resolved_listening(void) {
b8ea7a6e 2072 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
b053cd5f 2073 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
7357272e 2074 _cleanup_free_ char *dns_stub_listener_mode = NULL;
b053cd5f
LP		 2075 int r;
2076
7357272e 2077 /* Check if resolved is listening */
b053cd5f
LP		 2078
2079 r = sd_bus_open_system(&bus);
2080 if (r < 0)
b8ea7a6e 2081 return log_debug_errno(r, "Failed to open system bus: %m");
b053cd5f 2082
7357272e 2083 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
b8ea7a6e
LP		 2084 if (r < 0)
2085 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
2086 if (r == 0)
2087 return 0;
7357272e
DM		 2088
2089 r = sd_bus_get_property_string(bus,
2090 "org.freedesktop.resolve1",
2091 "/org/freedesktop/resolve1",
2092 "org.freedesktop.resolve1.Manager",
2093 "DNSStubListener",
b8ea7a6e 2094 &error,
7357272e
DM		 2095 &dns_stub_listener_mode);
2096 if (r < 0)
b8ea7a6e 2097 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
7357272e
DM		 2098
2099 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
b053cd5f
LP		 2100}
2101
2547bb41 2102static int setup_resolv_conf(const char *dest) {
09d423e9
LP		 2103 _cleanup_free_ char *etc = NULL;
2104 const char *where, *what;
2105 ResolvConfMode m;
2106 int r;
2547bb41
LP		 2107
2108 assert(dest);
2109
09d423e9
LP		 2110 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
2111 if (arg_private_network)
2112 m = RESOLV_CONF_OFF;
86775e35
LP		 2113 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
2114 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
09d423e9 2115 else if (have_resolv_conf("/etc/resolv.conf") > 0)
83205269 2116 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
09d423e9 2117 else
83205269 2118 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
86775e35 2119
09d423e9
LP		 2120 } else
2121 m = arg_resolv_conf;
2122
2123 if (m == RESOLV_CONF_OFF)
2547bb41
LP		 2124 return 0;
2125
f461a28d 2126 r = chase("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
87447ae4
LP		 2127 if (r < 0) {
2128 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
2129 return 0;
2130 }
2131
2132 where = strjoina(etc, "/resolv.conf");
09d423e9
LP		 2133
2134 if (m == RESOLV_CONF_DELETE) {
2135 if (unlink(where) < 0)
2136 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
2137
87447ae4
LP		 2138 return 0;
2139 }
79d80fc1 2140
86775e35
LP		 2141 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
2142 what = PRIVATE_STATIC_RESOLV_CONF;
2143 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
2144 what = PRIVATE_UPLINK_RESOLV_CONF;
2145 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
2146 what = PRIVATE_STUB_RESOLV_CONF;
09d423e9
LP		 2147 else
2148 what = "/etc/resolv.conf";
87447ae4 2149
86775e35 2150 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
09d423e9
LP		 2151 _cleanup_free_ char *resolved = NULL;
2152 int found;
2153
f461a28d 2154 found = chase(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
09d423e9
LP		 2155 if (found < 0) {
2156 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
2157 return 0;
2158 }
3539724c 2159
87447ae4
LP		 2160 if (found == 0) /* missing? */
2161 (void) touch(resolved);
5367354d 2162
511a8cfe 2163 r = mount_nofollow_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
60e76d48 2164 if (r >= 0)
511a8cfe 2165 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
86775e35
LP		 2166
2167 /* If that didn't work, let's copy the file */
3539724c
LP		 2168 }
2169
86775e35 2170 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
7c2f5495 2171 r = copy_file_atomic(what, where, 0644, COPY_REFLINK|COPY_REPLACE);
86775e35 2172 else
7c2f5495 2173 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, COPY_REFLINK);
79d80fc1 2174 if (r < 0) {
3539724c
LP		 2175 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
2176 * resolved or something similar runs inside and the symlink points there.
68a313c5 2177 *
3539724c 2178 * If the disk image is read-only, there's also no point in complaining.
68a313c5 2179 */
86775e35
LP		 2180 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
2181 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
3539724c 2182 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
79d80fc1
TG		 2183 return 0;
2184 }
2547bb41 2185
03cfe0d5
LP		 2186 r = userns_lchown(where, 0, 0);
2187 if (r < 0)
3539724c 2188 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
03cfe0d5 2189
2547bb41
LP		 2190 return 0;
2191}
2192
1e4f1671 2193static int setup_boot_id(void) {
cdde6ba6
LP		 2194 _cleanup_(unlink_and_freep) char *from = NULL;
2195 _cleanup_free_ char *path = NULL;
3bbaff3e 2196 sd_id128_t rnd = SD_ID128_NULL;
cdde6ba6 2197 const char *to;
04bc4a3f
LP		 2198 int r;
2199
1eacc470 2200 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
04bc4a3f 2201
1eacc470 2202 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
cdde6ba6
LP		 2203 if (r < 0)
2204 return log_error_errno(r, "Failed to generate random boot ID path: %m");
04bc4a3f
LP		 2205
2206 r = sd_id128_randomize(&rnd);
f647962d
MS		 2207 if (r < 0)
2208 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 2209
b40c8ebd 2210 r = id128_write(path, ID128_FORMAT_UUID, rnd);
f647962d
MS		 2211 if (r < 0)
2212 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 2213
cdde6ba6
LP		 2214 from = TAKE_PTR(path);
2215 to = "/proc/sys/kernel/random/boot_id";
2216
511a8cfe 2217 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
cdde6ba6
LP		 2218 if (r < 0)
2219 return r;
04bc4a3f 2220
511a8cfe 2221 return mount_nofollow_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
04bc4a3f
LP		 2222}
2223
e58a1277 2224static int copy_devnodes(const char *dest) {
88213476
LP		 2225 static const char devnodes[] =
2226 "null\0"
2227 "zero\0"
2228 "full\0"
2229 "random\0"
2230 "urandom\0"
85614d66
TG		 2231 "tty\0"
2232 "net/tun\0";
88213476 2233
e58a1277 2234 int r = 0;
a258bf26
LP		 2235
2236 assert(dest);
124640f1 2237
52f05ef2 2238 BLOCK_WITH_UMASK(0000);
88213476 2239
03cfe0d5
LP		 2240 /* Create /dev/net, so that we can create /dev/net/tun in it */
2241 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2242 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2243
88213476 2244 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 2245 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 2246 struct stat st;
88213476 2247
c6134d3e 2248 from = path_join("/dev/", d);
8967f291
LP		 2249 if (!from)
2250 return log_oom();
2251
c6134d3e 2252 to = path_join(dest, from);
8967f291
LP		 2253 if (!to)
2254 return log_oom();
88213476
LP		 2255
2256 if (stat(from, &st) < 0) {
2257
4a62c710
MS		 2258 if (errno != ENOENT)
2259 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 2260
baaa35ad
ZJS		 2261 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2262 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2263 "%s is not a char or block device, cannot copy.", from);
2264 else {
8dfce114
LP		 2265 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2266
81f5049b 2267 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
8dbf71ec 2268 /* Explicitly warn the user when /dev is already populated. */
41eb4362 2269 if (errno == EEXIST)
8dbf71ec 2270 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
81f5049b
AC		 2271 if (errno != EPERM)
2272 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2273
8dfce114 2274 /* Some systems abusively restrict mknod but allow bind mounts. */
81f5049b
AC		 2275 r = touch(to);
2276 if (r < 0)
2277 return log_error_errno(r, "touch (%s) failed: %m", to);
511a8cfe 2278 r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2279 if (r < 0)
2280 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
81f5049b 2281 }
6278cf60 2282
03cfe0d5
LP		 2283 r = userns_lchown(to, 0, 0);
2284 if (r < 0)
2285 return log_error_errno(r, "chown() of device node %s failed: %m", to);
8dfce114 2286
657ee2d8 2287 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
8dfce114
LP		 2288 if (!dn)
2289 return log_oom();
2290
2291 r = userns_mkdir(dest, dn, 0755, 0, 0);
2292 if (r < 0)
2293 return log_error_errno(r, "Failed to create '%s': %m", dn);
2294
2295 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2296 return log_oom();
2297
c6134d3e 2298 prefixed = path_join(dest, sl);
8dfce114
LP		 2299 if (!prefixed)
2300 return log_oom();
2301
2d9b74ba 2302 t = path_join("..", d);
8dfce114
LP		 2303 if (!t)
2304 return log_oom();
2305
2306 if (symlink(t, prefixed) < 0)
2307 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
88213476 2308 }
88213476
LP		 2309 }
2310
e58a1277
LP		 2311 return r;
2312}
88213476 2313
de40a303 2314static int make_extra_nodes(const char *dest) {
de40a303
LP		 2315 size_t i;
2316 int r;
2317
52f05ef2 2318 BLOCK_WITH_UMASK(0000);
de40a303
LP		 2319
2320 for (i = 0; i < arg_n_extra_nodes; i++) {
2321 _cleanup_free_ char *path = NULL;
2322 DeviceNode *n = arg_extra_nodes + i;
2323
c6134d3e 2324 path = path_join(dest, n->path);
de40a303
LP		 2325 if (!path)
2326 return log_oom();
2327
2328 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2329 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2330
2331 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2332 if (r < 0)
2333 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2334 }
2335
2336 return 0;
2337}
2338
03cfe0d5
LP		 2339static int setup_pts(const char *dest) {
2340 _cleanup_free_ char *options = NULL;
2341 const char *p;
709f6e46 2342 int r;
03cfe0d5 2343
349cc4a5 2344#if HAVE_SELINUX
03cfe0d5
LP		 2345 if (arg_selinux_apifs_context)
2346 (void) asprintf(&options,
3dce8915 2347 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 2348 arg_uid_shift + TTY_GID,
2349 arg_selinux_apifs_context);
2350 else
2351#endif
2352 (void) asprintf(&options,
3dce8915 2353 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 2354 arg_uid_shift + TTY_GID);
f2d88580 2355
03cfe0d5 2356 if (!options)
f2d88580
LP		 2357 return log_oom();
2358
03cfe0d5 2359 /* Mount /dev/pts itself */
cc9fce65 2360 p = prefix_roota(dest, "/dev/pts");
3f692e2e 2361 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e
ZJS		 2362 if (r < 0)
2363 return log_error_errno(r, "Failed to create /dev/pts: %m");
2364
511a8cfe 2365 r = mount_nofollow_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
60e76d48
ZJS		 2366 if (r < 0)
2367 return r;
709f6e46
MS		 2368 r = userns_lchown(p, 0, 0);
2369 if (r < 0)
2370 return log_error_errno(r, "Failed to chown /dev/pts: %m");
03cfe0d5
LP		 2371
2372 /* Create /dev/ptmx symlink */
2373 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 2374 if (symlink("pts/ptmx", p) < 0)
2375 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
709f6e46
MS		 2376 r = userns_lchown(p, 0, 0);
2377 if (r < 0)
2378 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
f2d88580 2379
03cfe0d5
LP		 2380 /* And fix /dev/pts/ptmx ownership */
2381 p = prefix_roota(dest, "/dev/pts/ptmx");
709f6e46
MS		 2382 r = userns_lchown(p, 0, 0);
2383 if (r < 0)
2384 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 2385
f2d88580
LP		 2386 return 0;
2387}
2388
3acc84eb 2389static int setup_stdio_as_dev_console(void) {
5bb1d7fb 2390 _cleanup_close_ int terminal = -EBADF;
e58a1277 2391 int r;
e58a1277 2392
335d2ead
LP		 2393 /* We open the TTY in O_NOCTTY mode, so that we do not become controller yet. We'll do that later
2394 * explicitly, if we are configured to. */
2395 terminal = open_terminal("/dev/console", O_RDWR|O_NOCTTY);
3acc84eb
FB		 2396 if (terminal < 0)
2397 return log_error_errno(terminal, "Failed to open console: %m");
e58a1277 2398
3acc84eb
FB		 2399 /* Make sure we can continue logging to the original stderr, even if
2400 * stderr points elsewhere now */
2401 r = log_dup_console();
2402 if (r < 0)
2403 return log_error_errno(r, "Failed to duplicate stderr: %m");
de40a303 2404
3acc84eb
FB		 2405 /* invalidates 'terminal' on success and failure */
2406 r = rearrange_stdio(terminal, terminal, terminal);
2fef50cd 2407 TAKE_FD(terminal);
f647962d 2408 if (r < 0)
3acc84eb
FB		 2409 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2410
2411 return 0;
2412}
88213476 2413
3acc84eb
FB		 2414static int setup_dev_console(const char *console) {
2415 _cleanup_free_ char *p = NULL;
2416 int r;
a258bf26 2417
3acc84eb
FB		 2418 /* Create /dev/console symlink */
2419 r = path_make_relative("/dev", console, &p);
81f5049b 2420 if (r < 0)
3acc84eb
FB		 2421 return log_error_errno(r, "Failed to create relative path: %m");
2422
2423 if (symlink(p, "/dev/console") < 0)
2424 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
a258bf26 2425
3acc84eb 2426 return 0;
e58a1277
LP		 2427}
2428
8e5430c4
LP		 2429static int setup_keyring(void) {
2430 key_serial_t keyring;
2431
6b000af4
LP		 2432 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2433 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2434 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2435 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2436 * into the container. */
8e5430c4
LP		 2437
2438 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2439 if (keyring == -1) {
2440 if (errno == ENOSYS)
2441 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
065b4774 2442 else if (ERRNO_IS_PRIVILEGE(errno))
8e5430c4
LP		 2443 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2444 else
2445 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2446 }
2447
2448 return 0;
2449}
2450
3652872a
LP		 2451static int setup_credentials(const char *root) {
2452 const char *q;
2453 int r;
2454
2455 if (arg_n_credentials <= 0)
2456 return 0;
2457
2458 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2459 if (r < 0)
2460 return log_error_errno(r, "Failed to create /run/host: %m");
2461
2462 r = userns_mkdir(root, "/run/host/credentials", 0700, 0, 0);
2463 if (r < 0)
2464 return log_error_errno(r, "Failed to create /run/host/credentials: %m");
2465
2466 q = prefix_roota(root, "/run/host/credentials");
511a8cfe 2467 r = mount_nofollow_verbose(LOG_ERR, NULL, q, "ramfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0700");
3652872a
LP		 2468 if (r < 0)
2469 return r;
2470
2471 for (size_t i = 0; i < arg_n_credentials; i++) {
2472 _cleanup_free_ char *j = NULL;
254d1313 2473 _cleanup_close_ int fd = -EBADF;
3652872a
LP		 2474
2475 j = path_join(q, arg_credentials[i].id);
2476 if (!j)
2477 return log_oom();
2478
2479 fd = open(j, O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC|O_NOFOLLOW, 0600);
2480 if (fd < 0)
2481 return log_error_errno(errno, "Failed to create credential file %s: %m", j);
2482
2483 r = loop_write(fd, arg_credentials[i].data, arg_credentials[i].size, /* do_poll= */ false);
2484 if (r < 0)
2485 return log_error_errno(r, "Failed to write credential to file %s: %m", j);
2486
2487 if (fchmod(fd, 0400) < 0)
2488 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", j);
2489
2490 if (arg_userns_mode != USER_NAMESPACE_NO) {
2491 if (fchown(fd, arg_uid_shift, arg_uid_shift) < 0)
2492 return log_error_errno(errno, "Failed to adjust ownership of %s: %m", j);
2493 }
2494 }
2495
2496 if (chmod(q, 0500) < 0)
2497 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", q);
2498
2499 r = userns_lchown(q, 0, 0);
2500 if (r < 0)
2501 return r;
2502
2503 /* Make both mount and superblock read-only now */
511a8cfe 2504 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
3652872a
LP		 2505 if (r < 0)
2506 return r;
2507
511a8cfe 2508 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0500");
3652872a
LP		 2509}
2510
5d9d3fcb 2511static int setup_kmsg(int fd_inner_socket) {
9ec5a93c
LP		 2512 _cleanup_(unlink_and_freep) char *from = NULL;
2513 _cleanup_free_ char *fifo = NULL;
254d1313 2514 _cleanup_close_ int fd = -EBADF;
9ec5a93c 2515 int r;
e58a1277 2516
5d9d3fcb 2517 assert(fd_inner_socket >= 0);
a258bf26 2518
52f05ef2 2519 BLOCK_WITH_UMASK(0000);
a258bf26 2520
30fd9a2d 2521 /* We create the kmsg FIFO as a temporary file in /run, but immediately delete it after bind mounting it to
9ec5a93c
LP		 2522 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2523 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2524 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2525
1eacc470 2526 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
9ec5a93c
LP		 2527 if (r < 0)
2528 return log_error_errno(r, "Failed to generate kmsg path: %m");
e58a1277 2529
9ec5a93c 2530 if (mkfifo(fifo, 0600) < 0)
03cfe0d5 2531 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
9ec5a93c
LP		 2532
2533 from = TAKE_PTR(fifo);
9ec5a93c 2534
511a8cfe 2535 r = mount_nofollow_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
60e76d48
ZJS		 2536 if (r < 0)
2537 return r;
e58a1277 2538
669fc4e5 2539 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
4a62c710
MS		 2540 if (fd < 0)
2541 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 2542
9ec5a93c 2543 /* Store away the fd in the socket, so that it stays open as long as we run the child */
5d9d3fcb 2544 r = send_one_fd(fd_inner_socket, fd, 0);
d9603714
DH		 2545 if (r < 0)
2546 return log_error_errno(r, "Failed to send FIFO fd: %m");
a258bf26 2547
25ea79fe 2548 return 0;
88213476
LP		 2549}
2550
761cf19d 2551struct ExposeArgs {
deff68e7
FW		 2552 union in_addr_union address4;
2553 union in_addr_union address6;
761cf19d
FW		 2554 struct FirewallContext *fw_ctx;
2555};
2556
1c4baffc 2557static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
99534007 2558 struct ExposeArgs *args = ASSERT_PTR(userdata);
6d0b55c2
LP		 2559
2560 assert(rtnl);
2561 assert(m);
6d0b55c2 2562
fb9044cb
LP		 2563 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
2564 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
6d0b55c2
LP		 2565 return 0;
2566}
2567
3a74cea5 2568static int setup_hostname(void) {
c818eef1 2569 int r;
3a74cea5 2570
0c582db0 2571 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
eb91eb18
LP		 2572 return 0;
2573
c818eef1
LP		 2574 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2575 if (r < 0)
2576 return log_error_errno(r, "Failed to set hostname: %m");
3a74cea5 2577
7027ff61 2578 return 0;
3a74cea5
LP		 2579}
2580
57fb9fb5 2581static int setup_journal(const char *directory) {
0f5e1382 2582 _cleanup_free_ char *d = NULL;
5980d463 2583 const char *p, *q;
b2238e38 2584 sd_id128_t this_id;
8054d749 2585 bool try;
57fb9fb5
LP		 2586 int r;
2587
df9a75e4
LP		 2588 /* Don't link journals in ephemeral mode */
2589 if (arg_ephemeral)
2590 return 0;
2591
8054d749
LP		 2592 if (arg_link_journal == LINK_NO)
2593 return 0;
2594
2595 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2596
4d680aee 2597 r = sd_id128_get_machine(&this_id);
f647962d
MS		 2598 if (r < 0)
2599 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee 2600
e01ff70a 2601 if (sd_id128_equal(arg_uuid, this_id)) {
8054d749 2602 log_full(try ? LOG_WARNING : LOG_ERR,
85b55869 2603 "Host and machine ids are equal (%s): refusing to link journals", SD_ID128_TO_STRING(arg_uuid));
8054d749 2604 if (try)
4d680aee 2605 return 0;
df9a75e4 2606 return -EEXIST;
4d680aee
ZJS		 2607 }
2608
369ca6da
ZJS		 2609 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2610 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2611 if (r < 0) {
2612 bool ignore = r == -EROFS && try;
2613 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2614 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2615 return ignore ? 0 : r;
2616 }
2617 }
03cfe0d5 2618
85b55869 2619 p = strjoina("/var/log/journal/", SD_ID128_TO_STRING(arg_uuid));
03cfe0d5 2620 q = prefix_roota(directory, p);
27407a01 2621
e1873695 2622 if (path_is_mount_point(p, NULL, 0) > 0) {
8054d749
LP		 2623 if (try)
2624 return 0;
27407a01 2625
baaa35ad
ZJS		 2626 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2627 "%s: already a mount point, refusing to use for journal", p);
57fb9fb5
LP		 2628 }
2629
e1873695 2630 if (path_is_mount_point(q, NULL, 0) > 0) {
8054d749
LP		 2631 if (try)
2632 return 0;
57fb9fb5 2633
baaa35ad
ZJS		 2634 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2635 "%s: already a mount point, refusing to use for journal", q);
57fb9fb5
LP		 2636 }
2637
2638 r = readlink_and_make_absolute(p, &d);
2639 if (r >= 0) {
3742095b 2640 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
57fb9fb5
LP		 2641 path_equal(d, q)) {
2642
03cfe0d5 2643 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2644 if (r < 0)
709f6e46 2645 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2646 return 0;
57fb9fb5
LP		 2647 }
2648
4a62c710
MS		 2649 if (unlink(p) < 0)
2650 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 2651 } else if (r == -EINVAL) {
2652
2653 if (arg_link_journal == LINK_GUEST &&
2654 rmdir(p) < 0) {
2655
27407a01
ZJS		 2656 if (errno == ENOTDIR) {
2657 log_error("%s already exists and is neither a symlink nor a directory", p);
2658 return r;
4314d33f
MS		 2659 } else
2660 return log_error_errno(errno, "Failed to remove %s: %m", p);
57fb9fb5 2661 }
4314d33f
MS		 2662 } else if (r != -ENOENT)
2663 return log_error_errno(r, "readlink(%s) failed: %m", p);
57fb9fb5
LP		 2664
2665 if (arg_link_journal == LINK_GUEST) {
2666
2667 if (symlink(q, p) < 0) {
8054d749 2668 if (try) {
56f64d95 2669 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90 2670 return 0;
4314d33f
MS		 2671 } else
2672 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
57fb9fb5
LP		 2673 }
2674
03cfe0d5 2675 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2676 if (r < 0)
709f6e46 2677 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2678 return 0;
57fb9fb5
LP		 2679 }
2680
2681 if (arg_link_journal == LINK_HOST) {
ccddd104 2682 /* don't create parents here — if the host doesn't have
574edc90 2683 * permanent journal set up, don't force it here */
ba8e6c4d 2684
3f692e2e 2685 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e 2686 if (r < 0 && r != -EEXIST) {
8054d749 2687 if (try) {
dae8b82e 2688 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
574edc90 2689 return 0;
4314d33f 2690 } else
dae8b82e 2691 return log_error_errno(r, "Failed to create %s: %m", p);
57fb9fb5
LP		 2692 }
2693
27407a01
ZJS		 2694 } else if (access(p, F_OK) < 0)
2695 return 0;
57fb9fb5 2696
db55bbf2 2697 if (dir_is_empty(q, /* ignore_hidden_or_backup= */ false) == 0)
cdb2b9d0
LP		 2698 log_warning("%s is not empty, proceeding anyway.", q);
2699
03cfe0d5 2700 r = userns_mkdir(directory, p, 0755, 0, 0);
709f6e46
MS		 2701 if (r < 0)
2702 return log_error_errno(r, "Failed to create %s: %m", q);
57fb9fb5 2703
511a8cfe 2704 r = mount_nofollow_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
60e76d48 2705 if (r < 0)
4a62c710 2706 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 2707
27407a01 2708 return 0;
57fb9fb5
LP		 2709}
2710
de40a303
LP		 2711static int drop_capabilities(uid_t uid) {
2712 CapabilityQuintet q;
2713
2714 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2715 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2716 * arg_caps_retain. */
2717
2718 if (capability_quintet_is_set(&arg_full_capabilities)) {
2719 q = arg_full_capabilities;
2720
f5fbe71d 2721 if (q.bounding == UINT64_MAX)
de40a303
LP		 2722 q.bounding = uid == 0 ? arg_caps_retain : 0;
2723
f5fbe71d 2724 if (q.effective == UINT64_MAX)
de40a303
LP		 2725 q.effective = uid == 0 ? q.bounding : 0;
2726
f5fbe71d 2727 if (q.inheritable == UINT64_MAX)
88fc9c9b 2728 q.inheritable = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2729
f5fbe71d 2730 if (q.permitted == UINT64_MAX)
88fc9c9b 2731 q.permitted = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2732
f5fbe71d 2733 if (q.ambient == UINT64_MAX && ambient_capabilities_supported())
88fc9c9b 2734 q.ambient = arg_caps_ambient;
f66ad460
AZ		 2735
2736 if (capability_quintet_mangle(&q))
2737 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2738
2739 } else {
de40a303
LP		 2740 q = (CapabilityQuintet) {
2741 .bounding = arg_caps_retain,
2742 .effective = uid == 0 ? arg_caps_retain : 0,
88fc9c9b
TH		 2743 .inheritable = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2744 .permitted = uid == 0 ? arg_caps_retain : arg_caps_ambient,
f5fbe71d 2745 .ambient = ambient_capabilities_supported() ? arg_caps_ambient : UINT64_MAX,
de40a303
LP		 2746 };
2747
f66ad460
AZ		 2748 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2749 * in order to maintain the same behavior as systemd < 242. */
2750 if (capability_quintet_mangle(&q))
0ccdaa79
JT		 2751 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2752 "Some capabilities will not be set because they are not in the current bounding set.");
f66ad460
AZ		 2753
2754 }
2755
de40a303 2756 return capability_quintet_enforce(&q);
88213476
LP		 2757}
2758
db999e0f
LP		 2759static int reset_audit_loginuid(void) {
2760 _cleanup_free_ char *p = NULL;
2761 int r;
2762
0c582db0 2763 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
db999e0f
LP		 2764 return 0;
2765
2766 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 2767 if (r == -ENOENT)
db999e0f 2768 return 0;
f647962d
MS		 2769 if (r < 0)
2770 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 2771
2772 /* Already reset? */
2773 if (streq(p, "4294967295"))
2774 return 0;
2775
57512c89 2776 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
db999e0f 2777 if (r < 0) {
10a87006
LP		 2778 log_error_errno(r,
2779 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2780 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2781 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2782 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2783 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 2784
db999e0f 2785 sleep(5);
77b6e194 2786 }
db999e0f
LP		 2787
2788 return 0;
77b6e194
LP		 2789}
2790
e79581dd 2791static int mount_tunnel_dig(const char *root) {
785890ac 2792 const char *p, *q;
709f6e46 2793 int r;
785890ac
LP		 2794
2795 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2796 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 2797 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 2798 (void) mkdir_p(p, 0600);
2799
5a27b395 2800 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
709f6e46 2801 if (r < 0)
5a27b395 2802 return log_error_errno(r, "Failed to create /run/host: %m");
03cfe0d5 2803
e79581dd 2804 r = userns_mkdir(root, NSPAWN_MOUNT_TUNNEL, 0600, 0, 0);
709f6e46 2805 if (r < 0)
e79581dd 2806 return log_error_errno(r, "Failed to create "NSPAWN_MOUNT_TUNNEL": %m");
03cfe0d5 2807
e79581dd 2808 q = prefix_roota(root, NSPAWN_MOUNT_TUNNEL);
511a8cfe 2809 r = mount_nofollow_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2810 if (r < 0)
2811 return r;
785890ac 2812
511a8cfe 2813 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
60e76d48
ZJS		 2814 if (r < 0)
2815 return r;
785890ac 2816
e79581dd
CB		 2817 return 0;
2818}
2819
2820static int mount_tunnel_open(void) {
2821 int r;
2822
2823 r = mount_follow_verbose(LOG_ERR, NULL, NSPAWN_MOUNT_TUNNEL, NULL, MS_SLAVE, NULL);
2824 if (r < 0)
2825 return r;
2826
2827 return 0;
785890ac
LP		 2828}
2829
317feb4d 2830static int setup_machine_id(const char *directory) {
691675ba 2831 sd_id128_t id;
3bbaff3e 2832 int r;
e01ff70a 2833
317feb4d
LP		 2834 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2835 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2836 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2837 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2838 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2839 * container behaves nicely). */
2840
830e52ca 2841 r = id128_read(directory, "/etc/machine-id", ID128_FORMAT_PLAIN, &id);
317feb4d 2842 if (r < 0) {
74e795ee 2843 if (!ERRNO_IS_MACHINE_ID_UNSET(r)) /* If the file is missing, empty, or uninitialized, we don't mind */
317feb4d 2844 return log_error_errno(r, "Failed to read machine ID from container image: %m");
691675ba 2845
317feb4d
LP		 2846 if (sd_id128_is_null(arg_uuid)) {
2847 r = sd_id128_randomize(&arg_uuid);
2848 if (r < 0)
2849 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2850 }
2851 } else {
baaa35ad
ZJS		 2852 if (sd_id128_is_null(id))
2853 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2854 "Machine ID in container image is zero, refusing.");
e01ff70a 2855
317feb4d
LP		 2856 arg_uuid = id;
2857 }
691675ba 2858
e01ff70a
MS		 2859 return 0;
2860}
2861
7336138e
LP		 2862static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2863 int r;
2864
2865 assert(directory);
2866
6c045a99 2867 if (arg_userns_mode == USER_NAMESPACE_NO || arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_CHOWN)
7336138e
LP		 2868 return 0;
2869
2870 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2871 if (r == -EOPNOTSUPP)
2872 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2873 if (r == -EBADE)
2874 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2875 if (r < 0)
2876 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2877 if (r == 0)
2878 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2879 else
2880 log_debug("Patched directory tree to match UID/GID range.");
2881
2882 return r;
2883}
2884
113cea80 2885/*
6d416b9c
LS		 2886 * Return values:
2887 * < 0 : wait_for_terminate() failed to get the state of the
2888 * container, the container was terminated by a signal, or
2889 * failed for an unknown reason. No change is made to the
2890 * container argument.
2891 * > 0 : The program executed in the container terminated with an
2892 * error. The exit code of the program executed in the
919699ec
LP		 2893 * container is returned. The container argument has been set
2894 * to CONTAINER_TERMINATED.
6d416b9c
LS		 2895 * 0 : The container is being rebooted, has been shut down or exited
2896 * successfully. The container argument has been set to either
2897 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 2898 *
6d416b9c
LS		 2899 * That is, success is indicated by a return value of zero, and an
2900 * error is indicated by a non-zero value.
113cea80
DH		 2901 */
2902static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 2903 siginfo_t status;
919699ec 2904 int r;
113cea80
DH		 2905
2906 r = wait_for_terminate(pid, &status);
f647962d
MS		 2907 if (r < 0)
2908 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 2909
2910 switch (status.si_code) {
fddbb89c 2911
113cea80 2912 case CLD_EXITED:
b5a2179b 2913 if (status.si_status == 0)
919699ec 2914 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
b5a2179b 2915 else
919699ec 2916 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 2917
919699ec
LP		 2918 *container = CONTAINER_TERMINATED;
2919 return status.si_status;
113cea80
DH		 2920
2921 case CLD_KILLED:
2922 if (status.si_status == SIGINT) {
919699ec 2923 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 2924 *container = CONTAINER_TERMINATED;
919699ec
LP		 2925 return 0;
2926
113cea80 2927 } else if (status.si_status == SIGHUP) {
919699ec 2928 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 2929 *container = CONTAINER_REBOOTED;
919699ec 2930 return 0;
113cea80 2931 }
919699ec 2932
4831981d 2933 _fallthrough_;
113cea80 2934 case CLD_DUMPED:
baaa35ad
ZJS		 2935 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2936 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
113cea80
DH		 2937
2938 default:
baaa35ad
ZJS		 2939 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2940 "Container %s failed due to unknown reason.", arg_machine);
113cea80 2941 }
113cea80
DH		 2942}
2943
023fb90b
LP		 2944static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2945 pid_t pid;
2946
4a0b58c4 2947 pid = PTR_TO_PID(userdata);
023fb90b 2948 if (pid > 0) {
c6c8f6e2 2949 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 2950 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2951 sd_event_source_set_userdata(s, NULL);
2952 return 0;
2953 }
2954 }
2955
2956 sd_event_exit(sd_event_source_get_event(s), 0);
2957 return 0;
2958}
2959
6916b164 2960static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
abdb9b08
LP		 2961 pid_t pid;
2962
2963 assert(s);
2964 assert(ssi);
2965
2966 pid = PTR_TO_PID(userdata);
2967
6916b164
AU		 2968 for (;;) {
2969 siginfo_t si = {};
abdb9b08 2970
6916b164
AU		 2971 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2972 return log_error_errno(errno, "Failed to waitid(): %m");
2973 if (si.si_pid == 0) /* No pending children. */
2974 break;
abdb9b08 2975 if (si.si_pid == pid) {
6916b164
AU		 2976 /* The main process we care for has exited. Return from
2977 * signal handler but leave the zombie. */
2978 sd_event_exit(sd_event_source_get_event(s), 0);
2979 break;
2980 }
abdb9b08 2981
6916b164
AU		 2982 /* Reap all other children. */
2983 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2984 }
2985
2986 return 0;
2987}
2988
abdb9b08
LP		 2989static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2990 pid_t pid;
2991
2992 assert(m);
2993
2994 pid = PTR_TO_PID(userdata);
2995
2996 if (arg_kill_signal > 0) {
2997 log_info("Container termination requested. Attempting to halt container.");
2998 (void) kill(pid, arg_kill_signal);
2999 } else {
3000 log_info("Container termination requested. Exiting.");
3001 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
3002 }
3003
3004 return 0;
3005}
3006
ec16945e 3007static int determine_names(void) {
1b9cebf6 3008 int r;
ec16945e 3009
c1521918
LP		 3010 if (arg_template && !arg_directory && arg_machine) {
3011
3012 /* If --template= was specified then we should not
3013 * search for a machine, but instead create a new one
3014 * in /var/lib/machine. */
3015
657ee2d8 3016 arg_directory = path_join("/var/lib/machines", arg_machine);
c1521918
LP		 3017 if (!arg_directory)
3018 return log_oom();
3019 }
3020
ec16945e 3021 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 3022 if (arg_machine) {
3023 _cleanup_(image_unrefp) Image *i = NULL;
3024
d577d4a4 3025 r = image_find(IMAGE_MACHINE, arg_machine, NULL, &i);
3a6ce860
LP		 3026 if (r == -ENOENT)
3027 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
1b9cebf6
LP		 3028 if (r < 0)
3029 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
1b9cebf6 3030
eb38edce 3031 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
0f03c2a4 3032 r = free_and_strdup(&arg_image, i->path);
1b9cebf6 3033 else
0f03c2a4 3034 r = free_and_strdup(&arg_directory, i->path);
1b9cebf6 3035 if (r < 0)
0f3be6ca 3036 return log_oom();
1b9cebf6 3037
aee327b8
LP		 3038 if (!arg_ephemeral)
3039 arg_read_only = arg_read_only || i->read_only;
d7249575
LP		 3040 } else {
3041 r = safe_getcwd(&arg_directory);
3042 if (r < 0)
3043 return log_error_errno(r, "Failed to determine current directory: %m");
3044 }
ec16945e 3045
c6147113
LP		 3046 if (!arg_directory && !arg_image)
3047 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
ec16945e
LP		 3048 }
3049
3050 if (!arg_machine) {
b9ba4dab
LP		 3051 if (arg_directory && path_equal(arg_directory, "/"))
3052 arg_machine = gethostname_malloc();
e9b88a6d
LP		 3053 else if (arg_image) {
3054 char *e;
4827ab48 3055
b36e39d2
LP		 3056 r = path_extract_filename(arg_image, &arg_machine);
3057 if (r < 0)
3058 return log_error_errno(r, "Failed to extract file name from '%s': %m", arg_image);
4827ab48 3059
e9b88a6d
LP		 3060 /* Truncate suffix if there is one */
3061 e = endswith(arg_machine, ".raw");
3062 if (e)
3063 *e = 0;
b36e39d2
LP		 3064 } else {
3065 r = path_extract_filename(arg_directory, &arg_machine);
3066 if (r < 0)
3067 return log_error_errno(r, "Failed to extract file name from '%s': %m", arg_directory);
3068 }
ec16945e 3069
ae691c1d 3070 hostname_cleanup(arg_machine);
52ef5dd7 3071 if (!hostname_is_valid(arg_machine, 0))
c6147113 3072 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
b9ba4dab 3073
3603f151
LB		 3074 /* Copy the machine name before the random suffix is added below, otherwise we won't be able
3075 * to match fixed config file names. */
3076 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3077 if (!arg_settings_filename)
3078 return log_oom();
3079
e9b88a6d
LP		 3080 /* Add a random suffix when this is an ephemeral machine, so that we can run many
3081 * instances at once without manually having to specify -M each time. */
3082 if (arg_ephemeral)
3083 if (strextendf(&arg_machine, "-%016" PRIx64, random_u64()) < 0)
b9ba4dab 3084 return log_oom();
3603f151
LB		 3085 } else {
3086 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3087 if (!arg_settings_filename)
3088 return log_oom();
ec16945e
LP		 3089 }
3090
3091 return 0;
3092}
3093
f461a28d 3094static int chase_and_update(char **p, unsigned flags) {
3f342ec4
LP		 3095 char *chased;
3096 int r;
3097
3098 assert(p);
3099
3100 if (!*p)
3101 return 0;
3102
f461a28d 3103 r = chase(*p, NULL, flags, &chased, NULL);
3f342ec4
LP		 3104 if (r < 0)
3105 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
3106
a5648b80 3107 return free_and_replace(*p, chased);
3f342ec4
LP		 3108}
3109
03cfe0d5 3110static int determine_uid_shift(const char *directory) {
6dac160c 3111
0de7acce 3112 if (arg_userns_mode == USER_NAMESPACE_NO) {
03cfe0d5 3113 arg_uid_shift = 0;
6dac160c 3114 return 0;
03cfe0d5 3115 }
6dac160c
LP		 3116
3117 if (arg_uid_shift == UID_INVALID) {
3118 struct stat st;
3119
993da6d4
LP		 3120 /* Read the UID shift off the image. Maybe we can reuse this to avoid chowning. */
3121
3122 if (stat(directory, &st) < 0)
03cfe0d5 3123 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 3124
3125 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
3126
baaa35ad
ZJS		 3127 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
3128 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3129 "UID and GID base of %s don't match.", directory);
6dac160c
LP		 3130
3131 arg_uid_range = UINT32_C(0x10000);
f61c7f88
LP		 3132
3133 if (arg_uid_shift != 0) {
3134 /* If the image is shifted already, then we'll fall back to classic chowning, for
3135 * compatibility (and simplicity), or refuse if mapping is explicitly requested. */
3136
3137 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_AUTO) {
3138 log_debug("UID base of %s is non-zero, not using UID mapping.", directory);
3139 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3140 } else if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_MAP)
3141 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3142 "UID base of %s is not zero, UID mapping not supported.", directory);
3143 }
6dac160c
LP		 3144 }
3145
58e13de5
LP		 3146 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
3147 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID base too high for UID range.");
6dac160c 3148
6dac160c
LP		 3149 return 0;
3150}
3151
de40a303
LP		 3152static unsigned long effective_clone_ns_flags(void) {
3153 unsigned long flags = arg_clone_ns_flags;
3154
3155 if (arg_private_network)
3156 flags |= CLONE_NEWNET;
3157 if (arg_use_cgns)
3158 flags |= CLONE_NEWCGROUP;
3159 if (arg_userns_mode != USER_NAMESPACE_NO)
3160 flags |= CLONE_NEWUSER;
3161
3162 return flags;
3163}
3164
3165static int patch_sysctl(void) {
3166
3167 /* This table is inspired by runc's sysctl() function */
3168 static const struct {
3169 const char *key;
3170 bool prefix;
3171 unsigned long clone_flags;
3172 } safe_sysctl[] = {
3173 { "kernel.hostname", false, CLONE_NEWUTS },
3174 { "kernel.domainname", false, CLONE_NEWUTS },
3175 { "kernel.msgmax", false, CLONE_NEWIPC },
3176 { "kernel.msgmnb", false, CLONE_NEWIPC },
3177 { "kernel.msgmni", false, CLONE_NEWIPC },
3178 { "kernel.sem", false, CLONE_NEWIPC },
3179 { "kernel.shmall", false, CLONE_NEWIPC },
3180 { "kernel.shmmax", false, CLONE_NEWIPC },
3181 { "kernel.shmmni", false, CLONE_NEWIPC },
3182 { "fs.mqueue.", true, CLONE_NEWIPC },
3183 { "net.", true, CLONE_NEWNET },
3184 };
3185
3186 unsigned long flags;
de40a303
LP		 3187 int r;
3188
3189 flags = effective_clone_ns_flags();
3190
3191 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
3192 bool good = false;
3193 size_t i;
3194
3195 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
3196
3197 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
3198 continue;
3199
3200 if (safe_sysctl[i].prefix)
3201 good = startswith(*k, safe_sysctl[i].key);
3202 else
3203 good = streq(*k, safe_sysctl[i].key);
3204
3205 if (good)
3206 break;
3207 }
3208
c6147113
LP		 3209 if (!good)
3210 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
de40a303
LP		 3211
3212 r = sysctl_write(*k, *v);
3213 if (r < 0)
3214 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
3215 }
3216
3217 return 0;
3218}
3219
03cfe0d5
LP		 3220static int inner_child(
3221 Barrier *barrier,
5d9d3fcb 3222 int fd_inner_socket,
e1bb4b0d
LB		 3223 FDSet *fds,
3224 char **os_release_pairs) {
69c79d3c 3225
03cfe0d5 3226 _cleanup_free_ char *home = NULL;
88614c8a 3227 size_t n_env = 1;
4ab3d29f
ZJS		 3228 char *envp[] = {
3229 (char*) "PATH=" DEFAULT_PATH_COMPAT,
6aadfa4c 3230 NULL, /* container */
03cfe0d5
LP		 3231 NULL, /* TERM */
3232 NULL, /* HOME */
3233 NULL, /* USER */
3234 NULL, /* LOGNAME */
3235 NULL, /* container_uuid */
3236 NULL, /* LISTEN_FDS */
3237 NULL, /* LISTEN_PID */
9c1e04d0 3238 NULL, /* NOTIFY_SOCKET */
3652872a 3239 NULL, /* CREDENTIALS_DIRECTORY */
b626f695 3240 NULL, /* LANG */
03cfe0d5
LP		 3241 NULL
3242 };
1a68e1e5 3243 const char *exec_target;
2371271c 3244 _cleanup_strv_free_ char **env_use = NULL;
de40a303 3245 int r, which_failed;
88213476 3246
b37469d7
LP		 3247 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
3248 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
3249 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
3250 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
3251 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
3252 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
3253 * namespace.
3254 *
3255 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
3256 * unshare(). See below. */
3257
03cfe0d5 3258 assert(barrier);
5d9d3fcb 3259 assert(fd_inner_socket >= 0);
88213476 3260
de40a303
LP		 3261 log_debug("Inner child is initializing.");
3262
0de7acce 3263 if (arg_userns_mode != USER_NAMESPACE_NO) {
03cfe0d5
LP		 3264 /* Tell the parent, that it now can write the UID map. */
3265 (void) barrier_place(barrier); /* #1 */
7027ff61 3266
03cfe0d5 3267 /* Wait until the parent wrote the UID map */
baaa35ad 3268 if (!barrier_place_and_sync(barrier)) /* #2 */
2a2e78e9 3269 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
88213476 3270
2a2e78e9
LP		 3271 /* Become the new root user inside our namespace */
3272 r = reset_uid_gid();
3273 if (r < 0)
3274 return log_error_errno(r, "Couldn't become new root: %m");
3275
3276 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
3277 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
3278 * propagation, but simply create new peer groups for all our mounts). */
511a8cfe 3279 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
2a2e78e9
LP		 3280 if (r < 0)
3281 return r;
3282 }
6d66bd3b 3283
0de7acce 3284 r = mount_all(NULL,
4f086aab 3285 arg_mount_settings | MOUNT_IN_USERNS,
0de7acce 3286 arg_uid_shift,
0de7acce 3287 arg_selinux_apifs_context);
03cfe0d5
LP		 3288 if (r < 0)
3289 return r;
3290
04413780
ZJS		 3291 if (!arg_network_namespace_path && arg_private_network) {
3292 r = unshare(CLONE_NEWNET);
3293 if (r < 0)
3294 return log_error_errno(errno, "Failed to unshare network namespace: %m");
75116558
PS		 3295
3296 /* Tell the parent that it can setup network interfaces. */
3297 (void) barrier_place(barrier); /* #3 */
04413780
ZJS		 3298 }
3299
4f086aab 3300 r = mount_sysfs(NULL, arg_mount_settings);
d8fc6a00
LP		 3301 if (r < 0)
3302 return r;
3303
03cfe0d5
LP		 3304 /* Wait until we are cgroup-ified, so that we
3305 * can mount the right cgroup path writable */
baaa35ad
ZJS		 3306 if (!barrier_place_and_sync(barrier)) /* #4 */
3307 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3308 "Parent died too early");
88213476 3309
489fae52 3310 if (arg_use_cgns) {
0996ef00
CB		 3311 r = unshare(CLONE_NEWCGROUP);
3312 if (r < 0)
04413780 3313 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
0996ef00
CB		 3314 r = mount_cgroups(
3315 "",
3316 arg_unified_cgroup_hierarchy,
3317 arg_userns_mode != USER_NAMESPACE_NO,
3318 arg_uid_shift,
3319 arg_uid_range,
5a8ff0e6 3320 arg_selinux_apifs_context,
ada54120 3321 true);
1433e0f2 3322 } else
0996ef00 3323 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
1433e0f2
LP		 3324 if (r < 0)
3325 return r;
ec16945e 3326
1e4f1671 3327 r = setup_boot_id();
03cfe0d5
LP		 3328 if (r < 0)
3329 return r;
ec16945e 3330
5d9d3fcb 3331 r = setup_kmsg(fd_inner_socket);
03cfe0d5
LP		 3332 if (r < 0)
3333 return r;
ec16945e 3334
de40a303
LP		 3335 r = mount_custom(
3336 "/",
3337 arg_custom_mounts,
3338 arg_n_custom_mounts,
de40a303 3339 0,
c0c8f718 3340 0,
de40a303 3341 arg_selinux_apifs_context,
5f0a6347 3342 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
de40a303
LP		 3343 if (r < 0)
3344 return r;
3345
03cfe0d5
LP		 3346 if (setsid() < 0)
3347 return log_error_errno(errno, "setsid() failed: %m");
3348
3349 if (arg_private_network)
df883de9 3350 (void) loopback_setup();
03cfe0d5 3351
7a8f6325 3352 if (arg_expose_ports) {
b07ee903 3353 r = expose_port_send_rtnl(fd_inner_socket);
7a8f6325
LP		 3354 if (r < 0)
3355 return r;
7a8f6325 3356 }
03cfe0d5 3357
3acc84eb 3358 if (arg_console_mode != CONSOLE_PIPE) {
5bb1d7fb 3359 _cleanup_close_ int master = -EBADF;
3acc84eb
FB		 3360 _cleanup_free_ char *console = NULL;
3361
3362 /* Allocate a pty and make it available as /dev/console. */
dc98caea 3363 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3acc84eb 3364 if (master < 0)
dc98caea 3365 return log_error_errno(master, "Failed to allocate a pty: %m");
3acc84eb
FB		 3366
3367 r = setup_dev_console(console);
3368 if (r < 0)
105a1a36 3369 return log_error_errno(r, "Failed to set up /dev/console: %m");
3acc84eb 3370
bb1aa185 3371 r = send_one_fd(fd_inner_socket, master, 0);
3acc84eb
FB		 3372 if (r < 0)
3373 return log_error_errno(r, "Failed to send master fd: %m");
3acc84eb
FB		 3374
3375 r = setup_stdio_as_dev_console();
3376 if (r < 0)
3377 return r;
3378 }
3379
de40a303
LP		 3380 r = patch_sysctl();
3381 if (r < 0)
3382 return r;
3383
81f345df
LP		 3384 if (arg_oom_score_adjust_set) {
3385 r = set_oom_score_adjust(arg_oom_score_adjust);
3386 if (r < 0)
3387 return log_error_errno(r, "Failed to adjust OOM score: %m");
3388 }
3389
0985c7c4
ZJS		 3390 if (arg_cpu_set.set)
3391 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
d107bb7d
LP		 3392 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3393
c818eef1 3394 (void) setup_hostname();
03cfe0d5 3395
050f7277 3396 if (arg_personality != PERSONALITY_INVALID) {
21022b9d
LP		 3397 r = safe_personality(arg_personality);
3398 if (r < 0)
3399 return log_error_errno(r, "personality() failed: %m");
4c27749b
LP		 3400#ifdef ARCHITECTURE_SECONDARY
3401 } else if (arg_architecture == ARCHITECTURE_SECONDARY) {
21022b9d
LP		 3402 r = safe_personality(PER_LINUX32);
3403 if (r < 0)
3404 return log_error_errno(r, "personality() failed: %m");
4c27749b
LP		 3405#endif
3406 } else if (arg_architecture >= 0 && arg_architecture != native_architecture())
3407 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3408 "Selected architecture '%s' not supported locally, refusing.",
3409 architecture_to_string(arg_architecture));
03cfe0d5 3410
de40a303
LP		 3411 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3412 if (r < 0)
3413 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3414
3415#if HAVE_SECCOMP
3416 if (arg_seccomp) {
3417
3418 if (is_seccomp_available()) {
3419
3420 r = seccomp_load(arg_seccomp);
7bc5e0b1 3421 if (ERRNO_IS_SECCOMP_FATAL(r))
de40a303
LP		 3422 return log_error_errno(r, "Failed to install seccomp filter: %m");
3423 if (r < 0)
3424 log_debug_errno(r, "Failed to install seccomp filter: %m");
3425 }
3426 } else
3427#endif
3428 {
6b000af4 3429 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
de40a303
LP		 3430 if (r < 0)
3431 return r;
3432 }
3433
4a4654e0 3434 if (arg_suppress_sync) {
20e458ae 3435#if HAVE_SECCOMP
4a4654e0
LP		 3436 r = seccomp_suppress_sync();
3437 if (r < 0)
3438 log_debug_errno(r, "Failed to install sync() suppression seccomp filter, ignoring: %m");
20e458ae 3439#else
2db32618 3440 log_debug("systemd is built without SECCOMP support. Ignoring --suppress-sync= command line option and SuppressSync= setting.");
20e458ae 3441#endif
4a4654e0
LP		 3442 }
3443
349cc4a5 3444#if HAVE_SELINUX
03cfe0d5 3445 if (arg_selinux_context)
2ed96880 3446 if (setexeccon(arg_selinux_context) < 0)
03cfe0d5
LP		 3447 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3448#endif
3449
de40a303
LP		 3450 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3451 * if we need to later on. */
3452 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3453 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3454
3455 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3462d773 3456 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids, arg_console_mode != CONSOLE_PIPE);
de40a303 3457 else
3462d773 3458 r = change_uid_gid(arg_user, arg_console_mode != CONSOLE_PIPE, &home);
03cfe0d5
LP		 3459 if (r < 0)
3460 return r;
3461
de40a303
LP		 3462 r = drop_capabilities(getuid());
3463 if (r < 0)
3464 return log_error_errno(r, "Dropping capabilities failed: %m");
3465
66edd963
LP		 3466 if (arg_no_new_privileges)
3467 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3468 return log_error_errno(errno, "Failed to disable new privileges: %m");
3469
6aadfa4c
ILG		 3470 /* LXC sets container=lxc, so follow the scheme here */
3471 envp[n_env++] = strjoina("container=", arg_container_service_name);
3472
03cfe0d5
LP		 3473 envp[n_env] = strv_find_prefix(environ, "TERM=");
3474 if (envp[n_env])
313cefa1 3475 n_env++;
03cfe0d5 3476
de40a303 3477 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f 3478 if (asprintf(envp + n_env++, "HOME=%s", home ?: "/root") < 0)
de40a303
LP		 3479 return log_oom();
3480
3481 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f 3482 if (asprintf(envp + n_env++, "USER=%s", arg_user ?: "root") < 0 ||
1da3cb81 3483 asprintf(envp + n_env++, "LOGNAME=%s", arg_user ?: "root") < 0)
de40a303 3484 return log_oom();
03cfe0d5 3485
3bbaff3e 3486 assert(!sd_id128_is_null(arg_uuid));
03cfe0d5 3487
b7416360 3488 if (asprintf(envp + n_env++, "container_uuid=%s", SD_ID128_TO_UUID_STRING(arg_uuid)) < 0)
e01ff70a 3489 return log_oom();
03cfe0d5
LP		 3490
3491 if (fdset_size(fds) > 0) {
3492 r = fdset_cloexec(fds, false);
3493 if (r < 0)
3494 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3495
4ab3d29f
ZJS		 3496 if ((asprintf(envp + n_env++, "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3497 (asprintf(envp + n_env++, "LISTEN_PID=1") < 0))
03cfe0d5
LP		 3498 return log_oom();
3499 }
4ab3d29f 3500 if (asprintf(envp + n_env++, "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
9c1e04d0 3501 return log_oom();
03cfe0d5 3502
3652872a
LP		 3503 if (arg_n_credentials > 0) {
3504 envp[n_env] = strdup("CREDENTIALS_DIRECTORY=/run/host/credentials");
3505 if (!envp[n_env])
3506 return log_oom();
3507 n_env++;
3508 }
3509
b626f695 3510 if (arg_start_mode != START_BOOT) {
a22f5186 3511 envp[n_env] = strdup("LANG=" SYSTEMD_NSPAWN_LOCALE);
b626f695
DDM		 3512 if (!envp[n_env])
3513 return log_oom();
3514 n_env++;
3515 }
3516
4ab3d29f 3517 env_use = strv_env_merge(envp, os_release_pairs, arg_setenv);
2371271c
TG		 3518 if (!env_use)
3519 return log_oom();
03cfe0d5
LP		 3520
3521 /* Let the parent know that we are ready and
3522 * wait until the parent is ready with the
3523 * setup, too... */
baaa35ad 3524 if (!barrier_place_and_sync(barrier)) /* #5 */
335d2ead 3525 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
03cfe0d5 3526
5f932eb9
LP		 3527 if (arg_chdir)
3528 if (chdir(arg_chdir) < 0)
3529 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3530
7732f92b 3531 if (arg_start_mode == START_PID2) {
75bf701f 3532 r = stub_pid1(arg_uuid);
7732f92b
LP		 3533 if (r < 0)
3534 return r;
3535 }
3536
335d2ead
LP		 3537 if (arg_console_mode != CONSOLE_PIPE) {
3538 /* So far our pty wasn't controlled by any process. Finally, it's time to change that, if we
3539 * are configured for that. Acquire it as controlling tty. */
3540 if (ioctl(STDIN_FILENO, TIOCSCTTY) < 0)
3541 return log_error_errno(errno, "Failed to acquire controlling TTY: %m");
3542 }
3543
de40a303
LP		 3544 log_debug("Inner child completed, invoking payload.");
3545
8ca082b4
LP		 3546 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3547 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3548 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
03cfe0d5 3549 log_close();
8ca082b4 3550 log_set_open_when_needed(true);
a3b00f91 3551 log_settle_target();
8ca082b4 3552
03cfe0d5
LP		 3553 (void) fdset_close_others(fds);
3554
7732f92b 3555 if (arg_start_mode == START_BOOT) {
03cfe0d5
LP		 3556 char **a;
3557 size_t m;
3558
3559 /* Automatically search for the init system */
3560
75f32f04
ZJS		 3561 m = strv_length(arg_parameters);
3562 a = newa(char*, m + 2);
3563 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3564 a[1 + m] = NULL;
03cfe0d5 3565
a5096641
LP		 3566 FOREACH_STRING(init,
3567 "/usr/lib/systemd/systemd",
3568 "/lib/systemd/systemd",
3569 "/sbin/init") {
3570 a[0] = (char*) init;
3571 execve(a[0], a, env_use);
3572 }
ced58da7
LP		 3573
3574 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
1a68e1e5 3575 } else if (!strv_isempty(arg_parameters)) {
b6b180b7
LP		 3576 const char *dollar_path;
3577
1a68e1e5 3578 exec_target = arg_parameters[0];
b6b180b7
LP		 3579
3580 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3581 * binary. */
3582 dollar_path = strv_env_get(env_use, "PATH");
3583 if (dollar_path) {
6f646e01 3584 if (setenv("PATH", dollar_path, 1) < 0)
b6b180b7
LP		 3585 return log_error_errno(errno, "Failed to update $PATH: %m");
3586 }
3587
f757855e 3588 execvpe(arg_parameters[0], arg_parameters, env_use);
1a68e1e5 3589 } else {
5f932eb9 3590 if (!arg_chdir)
d929b0f9
ZJS		 3591 /* If we cannot change the directory, we'll end up in /, that is expected. */
3592 (void) chdir(home ?: "/root");
5f932eb9 3593
53350c7b 3594 execle(DEFAULT_USER_SHELL, "-" DEFAULT_USER_SHELL_NAME, NULL, env_use);
3595 if (!streq(DEFAULT_USER_SHELL, "/bin/bash"))
3596 execle("/bin/bash", "-bash", NULL, env_use);
3597 if (!streq(DEFAULT_USER_SHELL, "/bin/sh"))
3598 execle("/bin/sh", "-sh", NULL, env_use);
ced58da7 3599
53350c7b 3600 exec_target = DEFAULT_USER_SHELL ", /bin/bash, /bin/sh";
03cfe0d5
LP		 3601 }
3602
8ca082b4 3603 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
03cfe0d5
LP		 3604}
3605
e96ceaba 3606static int setup_notify_child(void) {
254d1313 3607 _cleanup_close_ int fd = -EBADF;
1eb874b9 3608 static const union sockaddr_union sa = {
44ed5214
LP		 3609 .un.sun_family = AF_UNIX,
3610 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
9c1e04d0
AP		 3611 };
3612 int r;
3613
3614 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3615 if (fd < 0)
3616 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3617
3618 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
fbda85b0 3619 (void) sockaddr_un_unlink(&sa.un);
9c1e04d0 3620
9c1e04d0 3621 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
271f518f 3622 if (r < 0)
44ed5214 3623 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
9c1e04d0 3624
adc7d9f0 3625 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
271f518f 3626 if (r < 0)
adc7d9f0 3627 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
adc7d9f0 3628
2ff48e98 3629 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
271f518f 3630 if (r < 0)
2ff48e98 3631 return log_error_errno(r, "SO_PASSCRED failed: %m");
9c1e04d0 3632
271f518f 3633 return TAKE_FD(fd);
9c1e04d0
AP		 3634}
3635
03cfe0d5
LP		 3636static int outer_child(
3637 Barrier *barrier,
3638 const char *directory,
2d845785 3639 DissectedImage *dissected_image,
af06cd30 3640 int fd_outer_socket,
5d9d3fcb 3641 int fd_inner_socket,
d7bea6b6
DP		 3642 FDSet *fds,
3643 int netns_fd) {
03cfe0d5 3644
2f893044 3645 _cleanup_(bind_user_context_freep) BindUserContext *bind_user_context = NULL;
e1bb4b0d 3646 _cleanup_strv_free_ char **os_release_pairs = NULL;
254d1313 3647 _cleanup_close_ int fd = -EBADF, mntns_fd = -EBADF;
f61c7f88 3648 bool idmap = false;
e5f10caf 3649 const char *p;
03cfe0d5
LP		 3650 pid_t pid;
3651 ssize_t l;
de40a303 3652 int r;
03cfe0d5 3653
d1d0b895
LP		 3654 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It
3655 * already has its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in
3656 * the host's CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET
3657 * namespaces. After it completed a number of initializations a second child (the "inner" one) is
3658 * forked off it, and it exits. */
b37469d7 3659
03cfe0d5
LP		 3660 assert(barrier);
3661 assert(directory);
af06cd30 3662 assert(fd_outer_socket >= 0);
5d9d3fcb 3663 assert(fd_inner_socket >= 0);
03cfe0d5 3664
de40a303
LP		 3665 log_debug("Outer child is initializing.");
3666
e1bb4b0d
LB		 3667 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3668 if (r < 0)
3669 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3670
03cfe0d5
LP		 3671 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3672 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3673
03cfe0d5
LP		 3674 r = reset_audit_loginuid();
3675 if (r < 0)
3676 return r;
3677
2a2e78e9
LP		 3678 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3679 * mounts to the real root. */
511a8cfe 3680 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
60e76d48
ZJS		 3681 if (r < 0)
3682 return r;
03cfe0d5 3683
2d845785 3684 if (dissected_image) {
d1d0b895
LP		 3685 /* If we are operating on a disk image, then mount its root directory now, but leave out the
3686 * rest. We can read the UID shift from it if we need to. Further down we'll mount the rest,
3687 * but then with the uid shift known. That way we can mount VFAT file systems shifted to the
3688 * right place right away. This makes sure ESP partitions and userns are compatible. */
2d3a5a73 3689
af187ab2 3690 r = dissected_image_mount_and_warn(
d04faa4e
LP		 3691 dissected_image,
3692 directory,
3693 arg_uid_shift,
21b61b1d 3694 arg_uid_range,
d04faa4e
LP		 3695 DISSECT_IMAGE_MOUNT_ROOT_ONLY|
3696 DISSECT_IMAGE_DISCARD_ON_LOOP|
3697 DISSECT_IMAGE_USR_NO_ROOT|
c65f854a 3698 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
af187ab2 3699 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
2d845785 3700 if (r < 0)
af187ab2 3701 return r;
2d845785 3702 }
03cfe0d5 3703
391567f4
LP		 3704 r = determine_uid_shift(directory);
3705 if (r < 0)
3706 return r;
3707
0de7acce 3708 if (arg_userns_mode != USER_NAMESPACE_NO) {
b71a0192
CB		 3709 r = namespace_open(0, NULL, &mntns_fd, NULL, NULL, NULL);
3710 if (r < 0)
3711 return log_error_errno(r, "Failed to pin outer mount namespace: %m");
3712
af06cd30 3713 l = send_one_fd(fd_outer_socket, mntns_fd, 0);
b71a0192
CB		 3714 if (l < 0)
3715 return log_error_errno(l, "Failed to send outer mount namespace fd: %m");
3716 mntns_fd = safe_close(mntns_fd);
3717
0e7ac751 3718 /* Let the parent know which UID shift we read from the image */
af06cd30 3719 l = send(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
825d5287
RM		 3720 if (l < 0)
3721 return log_error_errno(errno, "Failed to send UID shift: %m");
baaa35ad
ZJS		 3722 if (l != sizeof(arg_uid_shift))
3723 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3724 "Short write while sending UID shift.");
0e7ac751 3725
0de7acce 3726 if (arg_userns_mode == USER_NAMESPACE_PICK) {
d1d0b895
LP		 3727 /* When we are supposed to pick the UID shift, the parent will check now whether the
3728 * UID shift we just read from the image is available. If yes, it will send the UID
3729 * shift back to us, if not it will pick a different one, and send it back to us. */
0e7ac751 3730
af06cd30 3731 l = recv(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
0e7ac751
LP		 3732 if (l < 0)
3733 return log_error_errno(errno, "Failed to recv UID shift: %m");
baaa35ad
ZJS		 3734 if (l != sizeof(arg_uid_shift))
3735 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3736 "Short read while receiving UID shift.");
0e7ac751
LP		 3737 }
3738
ff6c6cc1
LP		 3739 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3740 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
825d5287
RM		 3741 }
3742
6f83d3d1
LP		 3743 if (path_equal(directory, "/")) {
3744 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3745 * place, so that we can make changes to its mount structure (for example, to implement
3746 * --volatile=) without this interfering with our ability to access files such as
3747 * /etc/localtime to copy into the container. Note that we use a fixed place for this
6c2d70ce 3748 * (instead of a temporary directory, since we are living in our own mount namespace here
7802194a 3749 * already, and thus don't need to be afraid of colliding with anyone else's mounts). */
6f83d3d1
LP		 3750 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3751
511a8cfe 3752 r = mount_nofollow_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
6f83d3d1
LP		 3753 if (r < 0)
3754 return r;
3755
3756 directory = "/run/systemd/nspawn-root";
e50cd82f 3757 }
7d0ecdd6 3758
75f81732
LP		 3759 /* Make sure we always have a mount that we can move to root later on. */
3760 r = make_mount_point(directory);
3761 if (r < 0)
3762 return r;
3763
3764 /* So the whole tree is now MS_SLAVE, i.e. we'll still receive mount/umount events from the host
3765 * mount namespace. For the directory we are going to run our container let's turn this off, so that
3766 * we'll live in our own little world from now on, and propagation from the host may only happen via
3767 * the mount tunnel dir, or not at all. */
3768 r = mount_follow_verbose(LOG_ERR, NULL, directory, NULL, MS_PRIVATE|MS_REC, NULL);
3769 if (r < 0)
3770 return r;
3771
7d0ecdd6
LP		 3772 r = setup_pivot_root(
3773 directory,
3774 arg_pivot_root_new,
3775 arg_pivot_root_old);
3776 if (r < 0)
3777 return r;
3778
3779 r = setup_volatile_mode(
3780 directory,
3781 arg_volatile_mode,
7d0ecdd6 3782 arg_uid_shift,
8f1ed04a 3783 arg_selinux_apifs_context);
7d0ecdd6
LP		 3784 if (r < 0)
3785 return r;
3786
2f893044
LP		 3787 r = bind_user_prepare(
3788 directory,
3789 arg_bind_user,
3790 arg_uid_shift,
3791 arg_uid_range,
3792 &arg_custom_mounts, &arg_n_custom_mounts,
3793 &bind_user_context);
3794 if (r < 0)
3795 return r;
3796
3797 if (arg_userns_mode != USER_NAMESPACE_NO && bind_user_context) {
d1d0b895
LP		 3798 /* Send the user maps we determined to the parent, so that it installs it in our user
3799 * namespace UID map table */
2f893044
LP		 3800
3801 for (size_t i = 0; i < bind_user_context->n_data; i++) {
3802 uid_t map[] = {
3803 bind_user_context->data[i].payload_user->uid,
3804 bind_user_context->data[i].host_user->uid,
3805 (uid_t) bind_user_context->data[i].payload_group->gid,
3806 (uid_t) bind_user_context->data[i].host_group->gid,
3807 };
3808
af06cd30 3809 l = send(fd_outer_socket, map, sizeof(map), MSG_NOSIGNAL);
2f893044
LP		 3810 if (l < 0)
3811 return log_error_errno(errno, "Failed to send user UID map: %m");
3812 if (l != sizeof(map))
3813 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3814 "Short write while sending user UID map.");
3815 }
3816 }
3817
5f0a6347
DDM		 3818 r = mount_custom(
3819 directory,
3820 arg_custom_mounts,
3821 arg_n_custom_mounts,
5f0a6347 3822 arg_uid_shift,
c0c8f718 3823 arg_uid_range,
5f0a6347
DDM		 3824 arg_selinux_apifs_context,
3825 MOUNT_ROOT_ONLY);
3826 if (r < 0)
3827 return r;
3828
c0c8f718
AV		 3829 if (arg_userns_mode != USER_NAMESPACE_NO &&
3830 IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
3831 arg_uid_shift != 0) {
3832
2b2777ed 3833 r = remount_idmap(directory, arg_uid_shift, arg_uid_range, UID_INVALID, REMOUNT_IDMAPPING_HOST_ROOT);
c0c8f718
AV		 3834 if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) {
3835 /* This might fail because the kernel or file system doesn't support idmapping. We
3836 * can't really distinguish this nicely, nor do we have any guarantees about the
3837 * error codes we see, could be EOPNOTSUPP or EINVAL. */
3838 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_AUTO)
3839 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3840 "ID mapped mounts are apparently not available, sorry.");
3841
3842 log_debug("ID mapped mounts are apparently not available on this kernel or for the selected file system, reverting to recursive chown()ing.");
3843 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3844 } else if (r < 0)
3845 return log_error_errno(r, "Failed to set up ID mapped mounts: %m");
3846 else {
3847 log_debug("ID mapped mounts available, making use of them.");
3848 idmap = true;
3849 }
3850 }
3851
2d3a5a73
LP		 3852 if (dissected_image) {
3853 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
d04faa4e
LP		 3854 r = dissected_image_mount(
3855 dissected_image,
3856 directory,
3857 arg_uid_shift,
21b61b1d 3858 arg_uid_range,
d04faa4e
LP		 3859 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|
3860 DISSECT_IMAGE_DISCARD_ON_LOOP|
3861 DISSECT_IMAGE_USR_NO_ROOT|
f61c7f88
LP		 3862 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3863 (idmap ? DISSECT_IMAGE_MOUNT_IDMAPPED : 0));
4fcb96ce
LP		 3864 if (r == -EUCLEAN)
3865 return log_error_errno(r, "File system check for image failed: %m");
2d3a5a73 3866 if (r < 0)
4fcb96ce 3867 return log_error_errno(r, "Failed to mount image file system: %m");
2d3a5a73
LP		 3868 }
3869
8199d554
LP		 3870 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3871 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3872
3873 r = detect_unified_cgroup_hierarchy_from_image(directory);
3874 if (r < 0)
3875 return r;
3876
fefb7a6d 3877 l = send(fd_outer_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
8199d554
LP		 3878 if (l < 0)
3879 return log_error_errno(errno, "Failed to send cgroup mode: %m");
baaa35ad
ZJS		 3880 if (l != sizeof(arg_unified_cgroup_hierarchy))
3881 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3882 "Short write while sending cgroup mode.");
8199d554
LP		 3883 }
3884
4ad14eff
LP		 3885 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3886 if (r < 0)
3887 return r;
3888
03cfe0d5
LP		 3889 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3890 if (r < 0)
3891 return r;
3892
bbd407ea
DDM		 3893 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3894 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
64e82c19 3895 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
03cfe0d5
LP		 3896 if (r < 0)
3897 return log_error_errno(r, "Failed to make tree read-only: %m");
3898 }
3899
0de7acce 3900 r = mount_all(directory,
4f086aab 3901 arg_mount_settings,
0de7acce 3902 arg_uid_shift,
0de7acce 3903 arg_selinux_apifs_context);
03cfe0d5
LP		 3904 if (r < 0)
3905 return r;
3906
07fa00f9
LP		 3907 r = copy_devnodes(directory);
3908 if (r < 0)
03cfe0d5
LP		 3909 return r;
3910
de40a303
LP		 3911 r = make_extra_nodes(directory);
3912 if (r < 0)
3913 return r;
3914
3915 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
e5f10caf 3916
9fac5029 3917 p = prefix_roota(directory, "/run/host");
e5f10caf 3918 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
03cfe0d5 3919
07fa00f9
LP		 3920 r = setup_pts(directory);
3921 if (r < 0)
03cfe0d5
LP		 3922 return r;
3923
e79581dd 3924 r = mount_tunnel_dig(directory);
03cfe0d5
LP		 3925 if (r < 0)
3926 return r;
3927
8e5430c4
LP		 3928 r = setup_keyring();
3929 if (r < 0)
3930 return r;
3931
3652872a
LP		 3932 r = setup_credentials(directory);
3933 if (r < 0)
3934 return r;
3935
2f893044
LP		 3936 r = bind_user_setup(bind_user_context, directory);
3937 if (r < 0)
3938 return r;
3939
5c4deb9a
MJ		 3940 r = mount_custom(
3941 directory,
3942 arg_custom_mounts,
3943 arg_n_custom_mounts,
3944 arg_uid_shift,
c0c8f718 3945 arg_uid_range,
5c4deb9a
MJ		 3946 arg_selinux_apifs_context,
3947 MOUNT_NON_ROOT_ONLY);
3948 if (r < 0)
3949 return r;
3950
03cfe0d5
LP		 3951 r = setup_timezone(directory);
3952 if (r < 0)
3953 return r;
3954
3955 r = setup_resolv_conf(directory);
3956 if (r < 0)
3957 return r;
3958
e01ff70a
MS		 3959 r = setup_machine_id(directory);
3960 if (r < 0)
3961 return r;
3962
03cfe0d5
LP		 3963 r = setup_journal(directory);
3964 if (r < 0)
3965 return r;
3966
0f48ba7b
LP		 3967 /* The same stuff as the $container env var, but nicely readable for the entire payload */
3968 p = prefix_roota(directory, "/run/host/container-manager");
3969 (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE);
3970
3971 /* The same stuff as the $container_uuid env var */
3972 p = prefix_roota(directory, "/run/host/container-uuid");
3973 (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
3974
489fae52 3975 if (!arg_use_cgns) {
0996ef00
CB		 3976 r = mount_cgroups(
3977 directory,
3978 arg_unified_cgroup_hierarchy,
3979 arg_userns_mode != USER_NAMESPACE_NO,
3980 arg_uid_shift,
3981 arg_uid_range,
5a8ff0e6 3982 arg_selinux_apifs_context,
ada54120 3983 false);
0996ef00
CB		 3984 if (r < 0)
3985 return r;
3986 }
03cfe0d5 3987
57c10a56
CB		 3988 /* Mark everything as shared so our mounts get propagated down. This is required to make new bind
3989 * mounts available in systemd services inside the container that create a new mount namespace. See
3990 * https://github.com/systemd/systemd/issues/3860 Further submounts (such as /dev) done after this
3991 * will inherit the shared propagation mode.
3992 *
3993 * IMPORTANT: Do not overmount the root directory anymore from now on to enable moving the root
3994 * directory mount to root later on.
3995 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3996 */
9d50f850 3997 r = mount_switch_root(directory, MS_SHARED);
03cfe0d5
LP		 3998 if (r < 0)
3999 return log_error_errno(r, "Failed to move root directory: %m");
4000
e79581dd
CB		 4001 /* We finished setting up the rootfs which is a shared mount. The mount tunnel needs to be a
4002 * dependent mount otherwise we can't MS_MOVE mounts that were propagated from the host into
4003 * the container. */
4004 r = mount_tunnel_open();
4005 if (r < 0)
4006 return r;
4007
b71a0192
CB		 4008 if (arg_userns_mode != USER_NAMESPACE_NO) {
4009 /* In order to mount procfs and sysfs in an unprivileged container the kernel
4010 * requires that a fully visible instance is already present in the target mount
4011 * namespace. Mount one here so the inner child can mount its own instances. Later
4012 * we umount the temporary instances created here before we actually exec the
4013 * payload. Since the rootfs is shared the umount will propagate into the container.
4014 * Note, the inner child wouldn't be able to unmount the instances on its own since
4015 * it doesn't own the originating mount namespace. IOW, the outer child needs to do
4016 * this. */
4017 r = pin_fully_visible_fs();
4018 if (r < 0)
4019 return r;
4020 }
4021
e96ceaba 4022 fd = setup_notify_child();
9c1e04d0
AP		 4023 if (fd < 0)
4024 return fd;
4025
03cfe0d5 4026 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
0c582db0 4027 arg_clone_ns_flags |
8869a0b4 4028 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
03cfe0d5
LP		 4029 if (pid < 0)
4030 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5 4031 if (pid == 0) {
af06cd30 4032 fd_outer_socket = safe_close(fd_outer_socket);
03cfe0d5 4033
2a2e78e9
LP		 4034 /* The inner child has all namespaces that are requested, so that we all are owned by the
4035 * user if user namespaces are turned on. */
03cfe0d5 4036
d7bea6b6
DP		 4037 if (arg_network_namespace_path) {
4038 r = namespace_enter(-1, -1, netns_fd, -1, -1);
4039 if (r < 0)
e2d39e54 4040 return log_error_errno(r, "Failed to join network namespace: %m");
d7bea6b6
DP		 4041 }
4042
11875a98 4043 r = inner_child(barrier, fd_inner_socket, fds, os_release_pairs);
03cfe0d5
LP		 4044 if (r < 0)
4045 _exit(EXIT_FAILURE);
4046
4047 _exit(EXIT_SUCCESS);
4048 }
4049
af06cd30 4050 l = send(fd_outer_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
03cfe0d5
LP		 4051 if (l < 0)
4052 return log_error_errno(errno, "Failed to send PID: %m");
baaa35ad
ZJS		 4053 if (l != sizeof(pid))
4054 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4055 "Short write while sending PID.");
03cfe0d5 4056
af06cd30 4057 l = send(fd_outer_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
e01ff70a
MS		 4058 if (l < 0)
4059 return log_error_errno(errno, "Failed to send machine ID: %m");
baaa35ad
ZJS		 4060 if (l != sizeof(arg_uuid))
4061 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4062 "Short write while sending machine ID.");
e01ff70a 4063
af06cd30 4064 l = send_one_fd(fd_outer_socket, fd, 0);
9c1e04d0 4065 if (l < 0)
ba72801d 4066 return log_error_errno(l, "Failed to send notify fd: %m");
9c1e04d0 4067
af06cd30 4068 fd_outer_socket = safe_close(fd_outer_socket);
5d9d3fcb 4069 fd_inner_socket = safe_close(fd_inner_socket);
d7bea6b6 4070 netns_fd = safe_close(netns_fd);
03cfe0d5
LP		 4071
4072 return 0;
4073}
4074
0e7ac751 4075static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
d381c8a6 4076 bool tried_hashed = false;
0e7ac751
LP		 4077 unsigned n_tries = 100;
4078 uid_t candidate;
4079 int r;
4080
4081 assert(shift);
4082 assert(ret_lock_file);
0de7acce 4083 assert(arg_userns_mode == USER_NAMESPACE_PICK);
0e7ac751
LP		 4084 assert(arg_uid_range == 0x10000U);
4085
4086 candidate = *shift;
4087
4088 (void) mkdir("/run/systemd/nspawn-uid", 0755);
4089
4090 for (;;) {
fbd0b64f 4091 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
8e766630 4092 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
0e7ac751
LP		 4093
4094 if (--n_tries <= 0)
4095 return -EBUSY;
4096
87d5e4f2 4097 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
0e7ac751
LP		 4098 goto next;
4099 if ((candidate & UINT32_C(0xFFFF)) != 0)
4100 goto next;
4101
4102 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
4103 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
4104 if (r == -EBUSY) /* Range already taken by another nspawn instance */
4105 goto next;
4106 if (r < 0)
4107 return r;
4108
4109 /* Make some superficial checks whether the range is currently known in the user database */
4110 if (getpwuid(candidate))
4111 goto next;
4112 if (getpwuid(candidate + UINT32_C(0xFFFE)))
4113 goto next;
4114 if (getgrgid(candidate))
4115 goto next;
4116 if (getgrgid(candidate + UINT32_C(0xFFFE)))
4117 goto next;
4118
4119 *ret_lock_file = lf;
4120 lf = (struct LockFile) LOCK_FILE_INIT;
4121 *shift = candidate;
4122 return 0;
4123
4124 next:
d381c8a6
LP		 4125 if (arg_machine && !tried_hashed) {
4126 /* Try to hash the base from the container name */
4127
4128 static const uint8_t hash_key[] = {
4129 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
4130 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
4131 };
4132
4133 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
4134
4135 tried_hashed = true;
4136 } else
4137 random_bytes(&candidate, sizeof(candidate));
4138
87d5e4f2 4139 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
0e7ac751
LP		 4140 candidate &= (uid_t) UINT32_C(0xFFFF0000);
4141 }
4142}
4143
2f893044
LP		 4144static int add_one_uid_map(
4145 char **p,
4146 uid_t container_uid,
4147 uid_t host_uid,
4148 uid_t range) {
4149
4150 return strextendf(p,
4151 UID_FMT " " UID_FMT " " UID_FMT "\n",
4152 container_uid, host_uid, range);
4153}
4154
4155static int make_uid_map_string(
4156 const uid_t bind_user_uid[],
4157 size_t n_bind_user_uid,
4158 size_t offset,
4159 char **ret) {
4160
4161 _cleanup_free_ char *s = NULL;
4162 uid_t previous_uid = 0;
4163 int r;
4164
4165 assert(n_bind_user_uid == 0 || bind_user_uid);
2f092762 4166 assert(IN_SET(offset, 0, 2)); /* used to switch between UID and GID map */
2f893044
LP		 4167 assert(ret);
4168
4169 /* The bind_user_uid[] array is a series of 4 uid_t values, for each --bind-user= entry one
4170 * quadruplet, consisting of host and container UID + GID. */
4171
4172 for (size_t i = 0; i < n_bind_user_uid; i++) {
05ab439a
YW		 4173 uid_t payload_uid = bind_user_uid[i*4+offset],
4174 host_uid = bind_user_uid[i*4+offset+1];
2f893044
LP		 4175
4176 assert(previous_uid <= payload_uid);
4177 assert(payload_uid < arg_uid_range);
4178
4179 /* Add a range to close the gap to previous entry */
4180 if (payload_uid > previous_uid) {
4181 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, payload_uid - previous_uid);
4182 if (r < 0)
4183 return r;
4184 }
4185
4186 /* Map this specific user */
4187 r = add_one_uid_map(&s, payload_uid, host_uid, 1);
4188 if (r < 0)
4189 return r;
4190
4191 previous_uid = payload_uid + 1;
4192 }
4193
4194 /* And add a range to close the gap to finish the range */
4195 if (arg_uid_range > previous_uid) {
4196 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, arg_uid_range - previous_uid);
4197 if (r < 0)
4198 return r;
4199 }
4200
4201 assert(s);
4202
4203 *ret = TAKE_PTR(s);
4204 return 0;
4205}
4206
4207static int setup_uid_map(
4208 pid_t pid,
4209 const uid_t bind_user_uid[],
4210 size_t n_bind_user_uid) {
4211
4212 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1];
4213 _cleanup_free_ char *s = NULL;
03cfe0d5
LP		 4214 int r;
4215
4216 assert(pid > 1);
4217
2f893044
LP		 4218 /* Build the UID map string */
4219 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 0, &s) < 0) /* offset=0 contains the UID pair */
4220 return log_oom();
4221
03cfe0d5 4222 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
2f893044 4223 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4224 if (r < 0)
4225 return log_error_errno(r, "Failed to write UID map: %m");
4226
2f893044
LP		 4227 /* And now build the GID map string */
4228 s = mfree(s);
4229 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 2, &s) < 0) /* offset=2 contains the GID pair */
4230 return log_oom();
4231
03cfe0d5 4232 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
2f893044 4233 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4234 if (r < 0)
4235 return log_error_errno(r, "Failed to write GID map: %m");
4236
4237 return 0;
4238}
4239
9c1e04d0 4240static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
9c1e04d0
AP		 4241 char buf[NOTIFY_BUFFER_MAX+1];
4242 char *p = NULL;
4243 struct iovec iovec = {
4244 .iov_base = buf,
4245 .iov_len = sizeof(buf)-1,
4246 };
fb29cdbe
LP		 4247 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
4248 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
9c1e04d0
AP		 4249 struct msghdr msghdr = {
4250 .msg_iov = &iovec,
4251 .msg_iovlen = 1,
4252 .msg_control = &control,
4253 .msg_controllen = sizeof(control),
4254 };
371d72e0 4255 struct ucred *ucred;
9c1e04d0
AP		 4256 ssize_t n;
4257 pid_t inner_child_pid;
4258 _cleanup_strv_free_ char **tags = NULL;
4bf4f50f 4259 int r;
9c1e04d0
AP		 4260
4261 assert(userdata);
4262
4263 inner_child_pid = PTR_TO_PID(userdata);
4264
4265 if (revents != EPOLLIN) {
4266 log_warning("Got unexpected poll event for notify fd.");
4267 return 0;
4268 }
4269
3691bcf3 4270 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
8add30a0
YW		 4271 if (n < 0) {
4272 if (ERRNO_IS_TRANSIENT(n))
4273 return 0;
4274 if (n == -EXFULL) {
4275 log_warning("Got message with truncated control data (too many fds sent?), ignoring.");
4276 return 0;
4277 }
3691bcf3 4278 return log_warning_errno(n, "Couldn't read notification socket: %m");
8add30a0 4279 }
9c1e04d0 4280
9c1e04d0
AP		 4281 cmsg_close_all(&msghdr);
4282
371d72e0 4283 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
9c1e04d0 4284 if (!ucred || ucred->pid != inner_child_pid) {
8cb57430 4285 log_debug("Received notify message without valid credentials. Ignoring.");
9c1e04d0
AP		 4286 return 0;
4287 }
4288
4289 if ((size_t) n >= sizeof(buf)) {
4290 log_warning("Received notify message exceeded maximum size. Ignoring.");
4291 return 0;
4292 }
4293
4294 buf[n] = 0;
4295 tags = strv_split(buf, "\n\r");
4296 if (!tags)
4297 return log_oom();
4298
d29cc4d6 4299 if (strv_contains(tags, "READY=1")) {
d4341b76 4300 r = sd_notify(false, "READY=1\n");
4bf4f50f
ZJS		 4301 if (r < 0)
4302 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
4303 }
9c1e04d0
AP		 4304
4305 p = strv_find_startswith(tags, "STATUS=");
4306 if (p)
04f590a4 4307 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
9c1e04d0
AP		 4308
4309 return 0;
4310}
4311
e96ceaba 4312static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
9c1e04d0 4313 int r;
9c1e04d0 4314
5773024d 4315 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
9c1e04d0
AP		 4316 if (r < 0)
4317 return log_error_errno(r, "Failed to allocate notify event source: %m");
4318
5773024d 4319 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
9c1e04d0
AP		 4320
4321 return 0;
4322}
4323
5d961407
LP		 4324static int merge_settings(Settings *settings, const char *path) {
4325 int rl;
f757855e 4326
5d961407
LP		 4327 assert(settings);
4328 assert(path);
f757855e 4329
5d961407
LP		 4330 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
4331 * that this steals the fields of the Settings* structure, and hence modifies it. */
f757855e 4332
7732f92b
LP		 4333 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
4334 settings->start_mode >= 0) {
4335 arg_start_mode = settings->start_mode;
130d3d22 4336 strv_free_and_replace(arg_parameters, settings->parameters);
f757855e
LP		 4337 }
4338
d3689b94
LP		 4339 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
4340 settings->ephemeral >= 0)
a2f577fc
JL		 4341 arg_ephemeral = settings->ephemeral;
4342
de40a303
LP		 4343 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
4344 settings->root) {
4345
4346 if (!arg_settings_trusted)
4347 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
4348 else
4349 free_and_replace(arg_directory, settings->root);
4350 }
4351
b53ede69
PW		 4352 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
4353 settings->pivot_root_new) {
4354 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
4355 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
4356 }
4357
5f932eb9 4358 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
1cc6c93a
YW		 4359 settings->working_directory)
4360 free_and_replace(arg_chdir, settings->working_directory);
5f932eb9 4361
f757855e 4362 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
130d3d22
YW		 4363 settings->environment)
4364 strv_free_and_replace(arg_setenv, settings->environment);
f757855e 4365
de40a303
LP		 4366 if ((arg_settings_mask & SETTING_USER) == 0) {
4367
4368 if (settings->user)
4369 free_and_replace(arg_user, settings->user);
4370
4371 if (uid_is_valid(settings->uid))
4372 arg_uid = settings->uid;
4373 if (gid_is_valid(settings->gid))
4374 arg_gid = settings->gid;
4375 if (settings->n_supplementary_gids > 0) {
4376 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
4377 arg_n_supplementary_gids = settings->n_supplementary_gids;
4378 }
4379 }
f757855e
LP		 4380
4381 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
a3fc6b55 4382 uint64_t plus, minus;
7be830c6 4383 uint64_t network_minus = 0;
88fc9c9b 4384 uint64_t ambient;
f757855e 4385
de40a303
LP		 4386 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
4387 * Settings structure */
4388
0e265674 4389 plus = settings->capability;
a3fc6b55
LP		 4390 minus = settings->drop_capability;
4391
9baa294c
LP		 4392 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4393 settings_network_configured(settings)) {
a3fc6b55
LP		 4394 if (settings_private_network(settings))
4395 plus |= UINT64_C(1) << CAP_NET_ADMIN;
4396 else
7be830c6 4397 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
a3fc6b55 4398 }
0e265674
LP		 4399
4400 if (!arg_settings_trusted && plus != 0) {
4401 if (settings->capability != 0)
5d961407 4402 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
7be830c6
TH		 4403 } else {
4404 arg_caps_retain &= ~network_minus;
520e0d54 4405 arg_caps_retain |= plus;
7be830c6 4406 }
f757855e 4407
a3fc6b55 4408 arg_caps_retain &= ~minus;
de40a303
LP		 4409
4410 /* Copy the full capabilities over too */
4411 if (capability_quintet_is_set(&settings->full_capabilities)) {
4412 if (!arg_settings_trusted)
5238e957 4413 log_warning("Ignoring capability settings, file %s is not trusted.", path);
de40a303
LP		 4414 else
4415 arg_full_capabilities = settings->full_capabilities;
4416 }
88fc9c9b
TH		 4417
4418 ambient = settings->ambient_capability;
4419 if (!arg_settings_trusted && ambient != 0)
4420 log_warning("Ignoring AmbientCapability= setting, file %s is not trusted.", path);
4421 else
4422 arg_caps_ambient |= ambient;
f757855e
LP		 4423 }
4424
4425 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
4426 settings->kill_signal > 0)
4427 arg_kill_signal = settings->kill_signal;
4428
4429 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
4430 settings->personality != PERSONALITY_INVALID)
4431 arg_personality = settings->personality;
4432
4433 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
4434 !sd_id128_is_null(settings->machine_id)) {
4435
4436 if (!arg_settings_trusted)
5d961407 4437 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
f757855e
LP		 4438 else
4439 arg_uuid = settings->machine_id;
4440 }
4441
4442 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
4443 settings->read_only >= 0)
4444 arg_read_only = settings->read_only;
4445
4446 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
4447 settings->volatile_mode != _VOLATILE_MODE_INVALID)
4448 arg_volatile_mode = settings->volatile_mode;
4449
4450 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
4451 settings->n_custom_mounts > 0) {
4452
4453 if (!arg_settings_trusted)
5d961407 4454 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
f757855e
LP		 4455 else {
4456 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
1cc6c93a 4457 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
f757855e 4458 arg_n_custom_mounts = settings->n_custom_mounts;
f757855e
LP		 4459 settings->n_custom_mounts = 0;
4460 }
4461 }
4462
4463 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
a1dfd585 4464 settings_network_configured(settings)) {
f757855e
LP		 4465
4466 if (!arg_settings_trusted)
5d961407 4467 log_warning("Ignoring network settings, file %s is not trusted.", path);
f757855e 4468 else {
f6d6bad1 4469 arg_network_veth = settings_network_veth(settings);
0e265674
LP		 4470 arg_private_network = settings_private_network(settings);
4471
130d3d22
YW		 4472 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
4473 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
4474 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
4475 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
f6d6bad1 4476
1cc6c93a
YW		 4477 free_and_replace(arg_network_bridge, settings->network_bridge);
4478 free_and_replace(arg_network_zone, settings->network_zone);
de40a303
LP		 4479
4480 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
f757855e
LP		 4481 }
4482 }
4483
4484 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
4485 settings->expose_ports) {
4486
4487 if (!arg_settings_trusted)
5d961407 4488 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
f757855e
LP		 4489 else {
4490 expose_port_free_all(arg_expose_ports);
1cc6c93a 4491 arg_expose_ports = TAKE_PTR(settings->expose_ports);
f757855e
LP		 4492 }
4493 }
4494
0de7acce
LP		 4495 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
4496 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
4497
4498 if (!arg_settings_trusted)
5d961407 4499 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
0de7acce
LP		 4500 else {
4501 arg_userns_mode = settings->userns_mode;
4502 arg_uid_shift = settings->uid_shift;
4503 arg_uid_range = settings->uid_range;
6c045a99 4504 arg_userns_ownership = settings->userns_ownership;
0de7acce
LP		 4505 }
4506 }
4507
0cc3c9f9
LP		 4508 if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
4509 !strv_isempty(settings->bind_user))
2f893044
LP		 4510 strv_free_and_replace(arg_bind_user, settings->bind_user);
4511
d3689b94
LP		 4512 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
4513 settings->notify_ready >= 0)
9c1e04d0
AP		 4514 arg_notify_ready = settings->notify_ready;
4515
960e4569
LP		 4516 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
4517
2d09ea44
LP		 4518 if (!strv_isempty(settings->syscall_allow_list) || !strv_isempty(settings->syscall_deny_list)) {
4519 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
4520 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
4521 else {
4522 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4523 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
4524 }
960e4569 4525 }
de40a303
LP		 4526
4527#if HAVE_SECCOMP
2d09ea44
LP		 4528 if (settings->seccomp) {
4529 if (!arg_settings_trusted)
4530 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4531 else {
4532 seccomp_release(arg_seccomp);
4533 arg_seccomp = TAKE_PTR(settings->seccomp);
4534 }
de40a303
LP		 4535 }
4536#endif
960e4569
LP		 4537 }
4538
bf428efb
LP		 4539 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4540 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4541 continue;
4542
4543 if (!settings->rlimit[rl])
4544 continue;
4545
4546 if (!arg_settings_trusted) {
5d961407 4547 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
bf428efb
LP		 4548 continue;
4549 }
4550
4551 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4552 }
4553
3a9530e5
LP		 4554 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4555 settings->hostname)
4556 free_and_replace(arg_hostname, settings->hostname);
4557
66edd963
LP		 4558 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4559 settings->no_new_privileges >= 0)
4560 arg_no_new_privileges = settings->no_new_privileges;
4561
81f345df
LP		 4562 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4563 settings->oom_score_adjust_set) {
4564
4565 if (!arg_settings_trusted)
5d961407 4566 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
81f345df
LP		 4567 else {
4568 arg_oom_score_adjust = settings->oom_score_adjust;
4569 arg_oom_score_adjust_set = true;
4570 }
4571 }
4572
d107bb7d 4573 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
0985c7c4 4574 settings->cpu_set.set) {
d107bb7d
LP		 4575
4576 if (!arg_settings_trusted)
5d961407 4577 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
d107bb7d 4578 else {
0985c7c4
ZJS		 4579 cpu_set_reset(&arg_cpu_set);
4580 arg_cpu_set = settings->cpu_set;
4581 settings->cpu_set = (CPUSet) {};
d107bb7d
LP		 4582 }
4583 }
4584
09d423e9
LP		 4585 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4586 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4587 arg_resolv_conf = settings->resolv_conf;
4588
4e1d6aa9
LP		 4589 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4590 settings->link_journal != _LINK_JOURNAL_INVALID) {
4591
4592 if (!arg_settings_trusted)
4593 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4594 else {
4595 arg_link_journal = settings->link_journal;
4596 arg_link_journal_try = settings->link_journal_try;
4597 }
4598 }
4599
1688841f
LP		 4600 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4601 settings->timezone != _TIMEZONE_MODE_INVALID)
4602 arg_timezone = settings->timezone;
4603
de40a303
LP		 4604 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4605 settings->slice) {
4606
4607 if (!arg_settings_trusted)
4608 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4609 else
4610 free_and_replace(arg_slice, settings->slice);
4611 }
4612
4613 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4614 settings->use_cgns >= 0) {
4615
4616 if (!arg_settings_trusted)
4617 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4618 else
4619 arg_use_cgns = settings->use_cgns;
4620 }
4621
4622 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
f5fbe71d 4623 settings->clone_ns_flags != ULONG_MAX) {
de40a303
LP		 4624
4625 if (!arg_settings_trusted)
4626 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4627 else
4628 arg_clone_ns_flags = settings->clone_ns_flags;
4629 }
4630
4631 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4632 settings->console_mode >= 0) {
4633
4634 if (!arg_settings_trusted)
4635 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4636 else
4637 arg_console_mode = settings->console_mode;
4638 }
4639
d3689b94
LP		 4640 if ((arg_settings_mask & SETTING_SUPPRESS_SYNC) == 0 &&
4641 settings->suppress_sync >= 0)
4a4654e0
LP		 4642 arg_suppress_sync = settings->suppress_sync;
4643
de40a303
LP		 4644 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4645 * don't consult arg_settings_mask for them. */
4646
4647 sd_bus_message_unref(arg_property_message);
4648 arg_property_message = TAKE_PTR(settings->properties);
4649
4650 arg_console_width = settings->console_width;
4651 arg_console_height = settings->console_height;
4652
b2645747 4653 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
de40a303
LP		 4654 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4655 arg_n_extra_nodes = settings->n_extra_nodes;
4656
f757855e
LP		 4657 return 0;
4658}
4659
5d961407
LP		 4660static int load_settings(void) {
4661 _cleanup_(settings_freep) Settings *settings = NULL;
4662 _cleanup_fclose_ FILE *f = NULL;
3603f151 4663 _cleanup_free_ char *p = NULL;
5d961407
LP		 4664 int r;
4665
de40a303
LP		 4666 if (arg_oci_bundle)
4667 return 0;
4668
5d961407
LP		 4669 /* If all settings are masked, there's no point in looking for
4670 * the settings file */
d7a0f1f4 4671 if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
5d961407
LP		 4672 return 0;
4673
5d961407
LP		 4674 /* We first look in the admin's directories in /etc and /run */
4675 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4676 _cleanup_free_ char *j = NULL;
4677
3603f151 4678 j = path_join(i, arg_settings_filename);
5d961407
LP		 4679 if (!j)
4680 return log_oom();
4681
4682 f = fopen(j, "re");
4683 if (f) {
4684 p = TAKE_PTR(j);
4685
4686 /* By default, we trust configuration from /etc and /run */
4687 if (arg_settings_trusted < 0)
4688 arg_settings_trusted = true;
4689
4690 break;
4691 }
4692
4693 if (errno != ENOENT)
4694 return log_error_errno(errno, "Failed to open %s: %m", j);
4695 }
4696
4697 if (!f) {
4698 /* After that, let's look for a file next to the
4699 * actual image we shall boot. */
4700
4701 if (arg_image) {
162f6477
LP		 4702 r = file_in_same_dir(arg_image, arg_settings_filename, &p);
4703 if (r < 0)
4704 return log_error_errno(r, "Failed to generate settings path from image path: %m");
4705 } else if (arg_directory) {
4706 r = file_in_same_dir(arg_directory, arg_settings_filename, &p);
4707 if (r < 0 && r != -EADDRNOTAVAIL) /* if directory is root fs, don't complain */
4708 return log_error_errno(r, "Failed to generate settings path from directory path: %m");
5d961407
LP		 4709 }
4710
4711 if (p) {
4712 f = fopen(p, "re");
4713 if (!f && errno != ENOENT)
4714 return log_error_errno(errno, "Failed to open %s: %m", p);
4715
4716 /* By default, we do not trust configuration from /var/lib/machines */
4717 if (arg_settings_trusted < 0)
4718 arg_settings_trusted = false;
4719 }
4720 }
4721
4722 if (!f)
4723 return 0;
4724
4725 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4726
4727 r = settings_load(f, p, &settings);
4728 if (r < 0)
4729 return r;
4730
4731 return merge_settings(settings, p);
4732}
4733
de40a303
LP		 4734static int load_oci_bundle(void) {
4735 _cleanup_(settings_freep) Settings *settings = NULL;
4736 int r;
4737
4738 if (!arg_oci_bundle)
4739 return 0;
4740
4741 /* By default let's trust OCI bundles */
4742 if (arg_settings_trusted < 0)
4743 arg_settings_trusted = true;
4744
4745 r = oci_load(NULL, arg_oci_bundle, &settings);
4746 if (r < 0)
4747 return r;
4748
4749 return merge_settings(settings, arg_oci_bundle);
4750}
4751
3acc84eb 4752static int run_container(
2d845785 4753 DissectedImage *dissected_image,
b0067625
ZJS		 4754 FDSet *fds,
4755 char veth_name[IFNAMSIZ], bool *veth_created,
761cf19d 4756 struct ExposeArgs *expose_args,
3acc84eb 4757 int *master, pid_t *pid, int *ret) {
b0067625
ZJS		 4758
4759 static const struct sigaction sa = {
4760 .sa_handler = nop_signal_handler,
e28c7cd0 4761 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
b0067625
ZJS		 4762 };
4763
8e766630 4764 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
5bb1d7fb 4765 _cleanup_close_ int etc_passwd_lock = -EBADF;
b0067625 4766 _cleanup_close_pair_ int
19ee48a6
YW		 4767 fd_inner_socket_pair[2] = PIPE_EBADF,
4768 fd_outer_socket_pair[2] = PIPE_EBADF;
8199d554 4769
5bb1d7fb 4770 _cleanup_close_ int notify_socket = -EBADF, mntns_fd = -EBADF, fd_kmsg_fifo = -EBADF;
b0067625 4771 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
5773024d 4772 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
b0067625
ZJS		 4773 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4774 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4775 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
abdb9b08 4776 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2f893044
LP		 4777 _cleanup_free_ uid_t *bind_user_uid = NULL;
4778 size_t n_bind_user_uid = 0;
b0067625 4779 ContainerStatus container_status = 0;
b0067625
ZJS		 4780 int ifi = 0, r;
4781 ssize_t l;
4782 sigset_t mask_chld;
254d1313 4783 _cleanup_close_ int child_netns_fd = -EBADF;
b0067625
ZJS		 4784
4785 assert_se(sigemptyset(&mask_chld) == 0);
4786 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4787
4788 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4789 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4790 * check with getpwuid() if the specific user already exists. Note that /etc might be
4791 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4792 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4793 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4794 * really ours. */
4795
4796 etc_passwd_lock = take_etc_passwd_lock(NULL);
4797 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4798 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4799 }
4800
4801 r = barrier_create(&barrier);
4802 if (r < 0)
4803 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4804
5d9d3fcb
CB		 4805 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_inner_socket_pair) < 0)
4806 return log_error_errno(errno, "Failed to create inner socket pair: %m");
4807
af06cd30
CB		 4808 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_outer_socket_pair) < 0)
4809 return log_error_errno(errno, "Failed to create outer socket pair: %m");
b0067625 4810
b0067625
ZJS		 4811 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4812 * parent's blocking calls and give it a chance to call wait() and terminate. */
4813 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4814 if (r < 0)
4815 return log_error_errno(errno, "Failed to change the signal mask: %m");
4816
4817 r = sigaction(SIGCHLD, &sa, NULL);
4818 if (r < 0)
4819 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4820
d7bea6b6 4821 if (arg_network_namespace_path) {
5b4855ab
DDM		 4822 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4823 if (child_netns_fd < 0)
d7bea6b6
DP		 4824 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4825
54c2459d 4826 r = fd_is_ns(child_netns_fd, CLONE_NEWNET);
6619ad88
LP		 4827 if (r == -EUCLEAN)
4828 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4829 else if (r < 0)
d7bea6b6 4830 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
c6147113
LP		 4831 else if (r == 0)
4832 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4833 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
d7bea6b6
DP		 4834 }
4835
b0067625
ZJS		 4836 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4837 if (*pid < 0)
4838 return log_error_errno(errno, "clone() failed%s: %m",
4839 errno == EINVAL ?
4840 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4841
4842 if (*pid == 0) {
4843 /* The outer child only has a file system namespace. */
4844 barrier_set_role(&barrier, BARRIER_CHILD);
4845
5d9d3fcb 4846 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
af06cd30 4847 fd_outer_socket_pair[0] = safe_close(fd_outer_socket_pair[0]);
b0067625
ZJS		 4848
4849 (void) reset_all_signal_handlers();
4850 (void) reset_signal_mask();
4851
4852 r = outer_child(&barrier,
4853 arg_directory,
2d845785 4854 dissected_image,
af06cd30 4855 fd_outer_socket_pair[1],
5d9d3fcb 4856 fd_inner_socket_pair[1],
d7bea6b6 4857 fds,
5b4855ab 4858 child_netns_fd);
b0067625
ZJS		 4859 if (r < 0)
4860 _exit(EXIT_FAILURE);
4861
4862 _exit(EXIT_SUCCESS);
4863 }
4864
4865 barrier_set_role(&barrier, BARRIER_PARENT);
4866
e4077ff6 4867 fdset_close(fds);
b0067625 4868
5d9d3fcb 4869 fd_inner_socket_pair[1] = safe_close(fd_inner_socket_pair[1]);
af06cd30 4870 fd_outer_socket_pair[1] = safe_close(fd_outer_socket_pair[1]);
b0067625
ZJS		 4871
4872 if (arg_userns_mode != USER_NAMESPACE_NO) {
af06cd30 4873 mntns_fd = receive_one_fd(fd_outer_socket_pair[0], 0);
b71a0192
CB		 4874 if (mntns_fd < 0)
4875 return log_error_errno(mntns_fd, "Failed to receive mount namespace fd from outer child: %m");
4876
b0067625 4877 /* The child just let us know the UID shift it might have read from the image. */
af06cd30 4878 l = recv(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
b0067625
ZJS		 4879 if (l < 0)
4880 return log_error_errno(errno, "Failed to read UID shift: %m");
c6147113
LP		 4881 if (l != sizeof arg_uid_shift)
4882 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
b0067625
ZJS		 4883
4884 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4885 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4886 * image, but if that's already in use, pick a new one, and report back to the child,
4887 * which one we now picked. */
4888
4889 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4890 if (r < 0)
4891 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4892
af06cd30 4893 l = send(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
b0067625
ZJS		 4894 if (l < 0)
4895 return log_error_errno(errno, "Failed to send UID shift: %m");
c6147113
LP		 4896 if (l != sizeof arg_uid_shift)
4897 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
b0067625 4898 }
2f893044
LP		 4899
4900 n_bind_user_uid = strv_length(arg_bind_user);
4901 if (n_bind_user_uid > 0) {
4902 /* Right after the UID shift, we'll receive the list of UID mappings for the
4903 * --bind-user= logic. Always a quadruplet of payload and host UID + GID. */
4904
4905 bind_user_uid = new(uid_t, n_bind_user_uid*4);
4906 if (!bind_user_uid)
4907 return log_oom();
4908
4909 for (size_t i = 0; i < n_bind_user_uid; i++) {
af06cd30 4910 l = recv(fd_outer_socket_pair[0], bind_user_uid + i*4, sizeof(uid_t)*4, 0);
2f893044
LP		 4911 if (l < 0)
4912 return log_error_errno(errno, "Failed to read user UID map pair: %m");
4913 if (l != sizeof(uid_t)*4)
4914 return log_full_errno(l == 0 ? LOG_DEBUG : LOG_WARNING,
4915 SYNTHETIC_ERRNO(EIO),
4916 "Short read while reading bind user UID pairs.");
4917 }
4918 }
b0067625
ZJS		 4919 }
4920
8199d554
LP		 4921 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4922 /* The child let us know the support cgroup mode it might have read from the image. */
fefb7a6d 4923 l = recv(fd_outer_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
8199d554
LP		 4924 if (l < 0)
4925 return log_error_errno(errno, "Failed to read cgroup mode: %m");
c6147113 4926 if (l != sizeof(arg_unified_cgroup_hierarchy))
c0f86d66 4927 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
c6147113 4928 l, l == 0 ? " The child is most likely dead." : "");
8199d554
LP		 4929 }
4930
b0067625 4931 /* Wait for the outer child. */
d2e0ac3d
LP		 4932 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4933 if (r < 0)
4934 return r;
4935 if (r != EXIT_SUCCESS)
4936 return -EIO;
b0067625
ZJS		 4937
4938 /* And now retrieve the PID of the inner child. */
af06cd30 4939 l = recv(fd_outer_socket_pair[0], pid, sizeof *pid, 0);
b0067625
ZJS		 4940 if (l < 0)
4941 return log_error_errno(errno, "Failed to read inner child PID: %m");
c6147113
LP		 4942 if (l != sizeof *pid)
4943 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
b0067625
ZJS		 4944
4945 /* We also retrieve container UUID in case it was generated by outer child */
af06cd30 4946 l = recv(fd_outer_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
b0067625
ZJS		 4947 if (l < 0)
4948 return log_error_errno(errno, "Failed to read container machine ID: %m");
c6147113
LP		 4949 if (l != sizeof(arg_uuid))
4950 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
b0067625
ZJS		 4951
4952 /* We also retrieve the socket used for notifications generated by outer child */
af06cd30 4953 notify_socket = receive_one_fd(fd_outer_socket_pair[0], 0);
b0067625
ZJS		 4954 if (notify_socket < 0)
4955 return log_error_errno(notify_socket,
4956 "Failed to receive notification socket from the outer child: %m");
4957
4958 log_debug("Init process invoked as PID "PID_FMT, *pid);
4959
4960 if (arg_userns_mode != USER_NAMESPACE_NO) {
c6147113
LP		 4961 if (!barrier_place_and_sync(&barrier)) /* #1 */
4962 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 4963
2f893044 4964 r = setup_uid_map(*pid, bind_user_uid, n_bind_user_uid);
b0067625
ZJS		 4965 if (r < 0)
4966 return r;
4967
4968 (void) barrier_place(&barrier); /* #2 */
4969 }
4970
4971 if (arg_private_network) {
75116558
PS		 4972 if (!arg_network_namespace_path) {
4973 /* Wait until the child has unshared its network namespace. */
c6147113
LP		 4974 if (!barrier_place_and_sync(&barrier)) /* #3 */
4975 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
75116558
PS		 4976 }
4977
5b4855ab
DDM		 4978 if (child_netns_fd < 0) {
4979 /* Make sure we have an open file descriptor to the child's network
4980 * namespace so it stays alive even if the child exits. */
4981 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
4982 if (r < 0)
4983 return log_error_errno(r, "Failed to open child network namespace: %m");
4984 }
4985
4986 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
b0067625
ZJS		 4987 if (r < 0)
4988 return r;
4989
4990 if (arg_network_veth) {
4991 r = setup_veth(arg_machine, *pid, veth_name,
4992 arg_network_bridge || arg_network_zone);
4993 if (r < 0)
4994 return r;
4995 else if (r > 0)
4996 ifi = r;
4997
4998 if (arg_network_bridge) {
4999 /* Add the interface to a bridge */
5000 r = setup_bridge(veth_name, arg_network_bridge, false);
5001 if (r < 0)
5002 return r;
5003 if (r > 0)
5004 ifi = r;
5005 } else if (arg_network_zone) {
5006 /* Add the interface to a bridge, possibly creating it */
5007 r = setup_bridge(veth_name, arg_network_zone, true);
5008 if (r < 0)
5009 return r;
5010 if (r > 0)
5011 ifi = r;
5012 }
5013 }
5014
5015 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
5016 if (r < 0)
5017 return r;
5018
5019 /* We created the primary and extra veth links now; let's remember this, so that we know to
5020 remove them later on. Note that we don't bother with removing veth links that were created
5021 here when their setup failed half-way, because in that case the kernel should be able to
5022 remove them on its own, since they cannot be referenced by anything yet. */
5023 *veth_created = true;
5024
5025 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
5026 if (r < 0)
5027 return r;
5028
5029 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
5030 if (r < 0)
5031 return r;
5032 }
5033
abdb9b08
LP		 5034 if (arg_register || !arg_keep_unit) {
5035 r = sd_bus_default_system(&bus);
5036 if (r < 0)
5037 return log_error_errno(r, "Failed to open system bus: %m");
e5a2d8b5
LP		 5038
5039 r = sd_bus_set_close_on_exit(bus, false);
5040 if (r < 0)
5041 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
abdb9b08
LP		 5042 }
5043
5044 if (!arg_keep_unit) {
5045 /* When a new scope is created for this container, then we'll be registered as its controller, in which
5046 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
5047 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
5048
75152a4d
LP		 5049 r = sd_bus_match_signal_async(
5050 bus,
5051 NULL,
5052 "org.freedesktop.systemd1",
5053 NULL,
5054 "org.freedesktop.systemd1.Scope",
5055 "RequestStop",
5056 on_request_stop, NULL, PID_TO_PTR(*pid));
abdb9b08 5057 if (r < 0)
75152a4d 5058 return log_error_errno(r, "Failed to request RequestStop match: %m");
abdb9b08
LP		 5059 }
5060
b0067625
ZJS		 5061 if (arg_register) {
5062 r = register_machine(
abdb9b08 5063 bus,
b0067625
ZJS		 5064 arg_machine,
5065 *pid,
5066 arg_directory,
5067 arg_uuid,
5068 ifi,
5069 arg_slice,
5070 arg_custom_mounts, arg_n_custom_mounts,
5071 arg_kill_signal,
5072 arg_property,
de40a303 5073 arg_property_message,
b0067625
ZJS		 5074 arg_keep_unit,
5075 arg_container_service_name);
5076 if (r < 0)
5077 return r;
abdb9b08 5078
cd2dfc6f
LP		 5079 } else if (!arg_keep_unit) {
5080 r = allocate_scope(
abdb9b08 5081 bus,
cd2dfc6f
LP		 5082 arg_machine,
5083 *pid,
5084 arg_slice,
5085 arg_custom_mounts, arg_n_custom_mounts,
5086 arg_kill_signal,
de40a303
LP		 5087 arg_property,
5088 arg_property_message);
cd2dfc6f
LP		 5089 if (r < 0)
5090 return r;
5091
5092 } else if (arg_slice || arg_property)
5093 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
b0067625 5094
27da7ef0 5095 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
b0067625
ZJS		 5096 if (r < 0)
5097 return r;
5098
27da7ef0 5099 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
720f0a2f
LP		 5100 if (r < 0)
5101 return r;
b0067625 5102
de54e02d 5103 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
b0067625
ZJS		 5104 if (r < 0)
5105 return r;
5106
5107 /* Notify the child that the parent is ready with all
5108 * its setup (including cgroup-ification), and that
5109 * the child can now hand over control to the code to
5110 * run inside the container. */
75116558 5111 (void) barrier_place(&barrier); /* #4 */
b0067625
ZJS		 5112
5113 /* Block SIGCHLD here, before notifying child.
5114 * process_pty() will handle it with the other signals. */
5115 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
5116
5117 /* Reset signal to default */
9c274488 5118 r = default_signals(SIGCHLD);
b0067625
ZJS		 5119 if (r < 0)
5120 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
5121
5122 r = sd_event_new(&event);
5123 if (r < 0)
5124 return log_error_errno(r, "Failed to get default event source: %m");
5125
8fd010bb
LP		 5126 (void) sd_event_set_watchdog(event, true);
5127
abdb9b08
LP		 5128 if (bus) {
5129 r = sd_bus_attach_event(bus, event, 0);
5130 if (r < 0)
5131 return log_error_errno(r, "Failed to attach bus to event loop: %m");
5132 }
5133
e96ceaba 5134 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
b0067625
ZJS		 5135 if (r < 0)
5136 return r;
5137
b71a0192
CB		 5138 if (arg_userns_mode != USER_NAMESPACE_NO) {
5139 r = wipe_fully_visible_fs(mntns_fd);
5140 if (r < 0)
5141 return r;
5142 mntns_fd = safe_close(mntns_fd);
5143 }
5144
b0067625 5145 /* Let the child know that we are ready and wait that the child is completely ready now. */
c6147113
LP		 5146 if (!barrier_place_and_sync(&barrier)) /* #5 */
5147 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 5148
38ccb557 5149 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
b0067625
ZJS		 5150 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
5151 etc_passwd_lock = safe_close(etc_passwd_lock);
5152
04f590a4
LP		 5153 (void) sd_notifyf(false,
5154 "STATUS=Container running.\n"
5155 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
4bf4f50f
ZJS		 5156 if (!arg_notify_ready) {
5157 r = sd_notify(false, "READY=1\n");
5158 if (r < 0)
5159 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
5160 }
b0067625
ZJS		 5161
5162 if (arg_kill_signal > 0) {
5163 /* Try to kill the init system on SIGINT or SIGTERM */
919f5ae0
LP		 5164 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
5165 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
b0067625
ZJS		 5166 } else {
5167 /* Immediately exit */
919f5ae0
LP		 5168 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
5169 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
b0067625
ZJS		 5170 }
5171
988851b6
LP		 5172 (void) sd_event_add_signal(event, NULL, SIGRTMIN+18, sigrtmin18_handler, NULL);
5173
5174 r = sd_event_add_memory_pressure(event, NULL, NULL, NULL);
5175 if (r < 0)
5176 log_debug_errno(r, "Failed allocate memory pressure event source, ignoring: %m");
5177
6916b164 5178 /* Exit when the child exits */
919f5ae0 5179 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
b0067625 5180
b07ee903
CB		 5181 /* Retrieve the kmsg fifo allocated by inner child */
5182 fd_kmsg_fifo = receive_one_fd(fd_inner_socket_pair[0], 0);
5183 if (fd_kmsg_fifo < 0)
5184 return log_error_errno(fd_kmsg_fifo, "Failed to receive kmsg fifo from inner child: %m");
5185
b0067625 5186 if (arg_expose_ports) {
b07ee903 5187 r = expose_port_watch_rtnl(event, fd_inner_socket_pair[0], on_address_change, expose_args, &rtnl);
b0067625
ZJS		 5188 if (r < 0)
5189 return r;
5190
deff68e7
FW		 5191 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5192 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5193 }
5194
3acc84eb 5195 if (arg_console_mode != CONSOLE_PIPE) {
254d1313 5196 _cleanup_close_ int fd = -EBADF;
3acc84eb 5197 PTYForwardFlags flags = 0;
de40a303 5198
3acc84eb 5199 /* Retrieve the master pty allocated by inner child */
bb1aa185 5200 fd = receive_one_fd(fd_inner_socket_pair[0], 0);
3acc84eb
FB		 5201 if (fd < 0)
5202 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
5203
5204 switch (arg_console_mode) {
de40a303 5205
3acc84eb
FB		 5206 case CONSOLE_READ_ONLY:
5207 flags |= PTY_FORWARD_READ_ONLY;
5208
5209 _fallthrough_;
5210
5211 case CONSOLE_INTERACTIVE:
5212 flags |= PTY_FORWARD_IGNORE_VHANGUP;
5213
5214 r = pty_forward_new(event, fd, flags, &forward);
5215 if (r < 0)
5216 return log_error_errno(r, "Failed to create PTY forwarder: %m");
5217
f5fbe71d 5218 if (arg_console_width != UINT_MAX || arg_console_height != UINT_MAX)
3acc84eb
FB		 5219 (void) pty_forward_set_width_height(forward,
5220 arg_console_width,
5221 arg_console_height);
5222 break;
5223
5224 default:
5225 assert(arg_console_mode == CONSOLE_PASSIVE);
5226 }
5227
5228 *master = TAKE_FD(fd);
de40a303 5229 }
b0067625 5230
5d9d3fcb
CB		 5231 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
5232
b0067625
ZJS		 5233 r = sd_event_loop(event);
5234 if (r < 0)
5235 return log_error_errno(r, "Failed to run event loop: %m");
5236
de40a303
LP		 5237 if (forward) {
5238 char last_char = 0;
b0067625 5239
de40a303
LP		 5240 (void) pty_forward_get_last_char(forward, &last_char);
5241 forward = pty_forward_free(forward);
b0067625 5242
de40a303
LP		 5243 if (!arg_quiet && last_char != '\n')
5244 putc('\n', stdout);
5245 }
b0067625
ZJS		 5246
5247 /* Kill if it is not dead yet anyway */
0bb0a9fa
ZJS		 5248 if (!arg_register && !arg_keep_unit && bus)
5249 terminate_scope(bus, arg_machine);
b0067625
ZJS		 5250
5251 /* Normally redundant, but better safe than sorry */
c67b0082 5252 (void) kill(*pid, SIGKILL);
b0067625 5253
5d9d3fcb
CB		 5254 fd_kmsg_fifo = safe_close(fd_kmsg_fifo);
5255
5b4855ab
DDM		 5256 if (arg_private_network) {
5257 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
5258 * to avoid having to move the parent to the child network namespace. */
5259 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
5260 if (r < 0)
5261 return r;
5262
5263 if (r == 0) {
254d1313 5264 _cleanup_close_ int parent_netns_fd = -EBADF;
5b4855ab
DDM		 5265
5266 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
5267 if (r < 0) {
5268 log_error_errno(r, "Failed to open parent network namespace: %m");
5269 _exit(EXIT_FAILURE);
5270 }
5271
5272 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
5273 if (r < 0) {
5274 log_error_errno(r, "Failed to enter child network namespace: %m");
5275 _exit(EXIT_FAILURE);
5276 }
5277
5278 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
5279 if (r < 0)
5280 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
5281
5282 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
5283 }
5284 }
5285
8f03de53 5286 r = wait_for_container(TAKE_PID(*pid), &container_status);
b0067625 5287
0bb0a9fa
ZJS		 5288 /* Tell machined that we are gone. */
5289 if (bus)
5290 (void) unregister_machine(bus, arg_machine);
5291
b0067625
ZJS		 5292 if (r < 0)
5293 /* We failed to wait for the container, or the container exited abnormally. */
5294 return r;
5295 if (r > 0 || container_status == CONTAINER_TERMINATED) {
27e29a1e
ZJS		 5296 /* r > 0 → The container exited with a non-zero status.
5297 * As a special case, we need to replace 133 with a different value,
5298 * because 133 is special-cased in the service file to reboot the container.
5299 * otherwise → The container exited with zero status and a reboot was not requested.
5300 */
2a49b612 5301 if (r == EXIT_FORCE_RESTART)
27e29a1e 5302 r = EXIT_FAILURE; /* replace 133 with the general failure code */
b0067625 5303 *ret = r;
b0067625
ZJS		 5304 return 0; /* finito */
5305 }
5306
5307 /* CONTAINER_REBOOTED, loop again */
5308
5309 if (arg_keep_unit) {
5310 /* Special handling if we are running as a service: instead of simply
5311 * restarting the machine we want to restart the entire service, so let's
5312 * inform systemd about this with the special exit code 133. The service
5313 * file uses RestartForceExitStatus=133 so that this results in a full
5314 * nspawn restart. This is necessary since we might have cgroup parameters
5315 * set we want to have flushed out. */
2a49b612
ZJS		 5316 *ret = EXIT_FORCE_RESTART;
5317 return 0; /* finito */
b0067625
ZJS		 5318 }
5319
deff68e7
FW		 5320 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5321 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5322
5323 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5324 *veth_created = false;
5325 return 1; /* loop again */
5326}
5327
bf428efb 5328static int initialize_rlimits(void) {
852b6250 5329 /* The default resource limits the kernel passes to PID 1, as per kernel 5.16. Let's pass our container payload
bf428efb
LP		 5330 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
5331 * container execution environments. */
5332
5333 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
852b6250
LP		 5334 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
5335 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
5336 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
5337 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
5338 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
5339 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
5340 [RLIMIT_MEMLOCK] = { DEFAULT_RLIMIT_MEMLOCK, DEFAULT_RLIMIT_MEMLOCK },
5341 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
5342 [RLIMIT_NICE] = { 0, 0 },
5343 [RLIMIT_NOFILE] = { 1024, 4096 },
5344 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
5345 [RLIMIT_RTPRIO] = { 0, 0 },
5346 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
5347 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
bf428efb
LP		 5348
5349 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
5350 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
5351 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
5352 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
5353 * that PID 1 changes a number of other resource limits during early initialization which is why we
5354 * don't read the other limits from PID 1 but prefer the static table above. */
5355 };
5356
5357 int rl;
5358
5359 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
bf428efb
LP		 5360 /* Let's only fill in what the user hasn't explicitly configured anyway */
5361 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
5362 const struct rlimit *v;
5363 struct rlimit buffer;
5364
5365 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
5366 /* For these two let's read the limits off PID 1. See above for an explanation. */
5367
5368 if (prlimit(1, rl, NULL, &buffer) < 0)
5369 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
5370
dbf1aca6
LP		 5371 v = &buffer;
5372 } else if (rl == RLIMIT_NOFILE) {
5373 /* We nowadays bump RLIMIT_NOFILE's hard limit early in PID 1 for all
5374 * userspace. Given that nspawn containers are often run without our PID 1,
5375 * let's grant the containers a raised RLIMIT_NOFILE hard limit by default,
5376 * so that container userspace gets similar resources as host userspace
5377 * gets. */
5378 buffer = kernel_defaults[rl];
5379 buffer.rlim_max = MIN((rlim_t) read_nr_open(), (rlim_t) HIGH_RLIMIT_NOFILE);
bf428efb
LP		 5380 v = &buffer;
5381 } else
5382 v = kernel_defaults + rl;
5383
5384 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
5385 if (!arg_rlimit[rl])
5386 return log_oom();
5387 }
5388
5389 if (DEBUG_LOGGING) {
5390 _cleanup_free_ char *k = NULL;
5391
5392 (void) rlimit_format(arg_rlimit[rl], &k);
5393 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
5394 }
5395 }
5396
5397 return 0;
5398}
5399
287b7376 5400static int cant_be_in_netns(void) {
254d1313 5401 _cleanup_close_ int fd = -EBADF;
287b7376
LP		 5402 struct ucred ucred;
5403 int r;
5404
5405 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
5406 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
5407 * nice message. */
5408
5409 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
5410 return 0;
5411
5412 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
5413 if (fd < 0)
5414 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
5415
1861986a
LP		 5416 r = connect_unix_path(fd, AT_FDCWD, "/run/udev/control");
5417 if (r < 0) {
5418 if (r == -ENOENT || ERRNO_IS_DISCONNECT(r))
287b7376
LP		 5419 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5420 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
5421
1861986a 5422 return log_error_errno(r, "Failed to connect socket to udev control socket: %m");
287b7376
LP		 5423 }
5424
5425 r = getpeercred(fd, &ucred);
5426 if (r < 0)
5427 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
5428
f7a2dc3d 5429 r = in_same_namespace(ucred.pid, 0, NAMESPACE_NET);
287b7376 5430 if (r < 0)
f7a2dc3d
CB		 5431 return log_error_errno(r, "Failed to determine network namespace of udev: %m");
5432 if (r == 0)
287b7376
LP		 5433 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5434 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
5435 return 0;
5436}
5437
44dbef90 5438static int run(int argc, char *argv[]) {
4c27749b 5439 bool remove_directory = false, remove_image = false, veth_created = false, remove_tmprootdir = false;
5bb1d7fb 5440 _cleanup_close_ int master = -EBADF;
03cfe0d5 5441 _cleanup_fdset_free_ FDSet *fds = NULL;
2d845785 5442 int r, n_fd_passed, ret = EXIT_SUCCESS;
5aa3eba5 5443 char veth_name[IFNAMSIZ] = "";
761cf19d 5444 struct ExposeArgs expose_args = {};
8e766630 5445 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
c67b0082 5446 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
2d845785 5447 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
18b5886e 5448 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
761cf19d 5449 _cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
7bf011e3 5450 pid_t pid = 0;
03cfe0d5
LP		 5451
5452 log_parse_environment();
5453 log_open();
415fc41c 5454
03cfe0d5
LP		 5455 r = parse_argv(argc, argv);
5456 if (r <= 0)
5457 goto finish;
5458
38ee19c0
ZJS		 5459 if (geteuid() != 0) {
5460 r = log_warning_errno(SYNTHETIC_ERRNO(EPERM),
5461 argc >= 2 ? "Need to be root." :
5462 "Need to be root (and some arguments are usually required).\nHint: try --help");
03cfe0d5 5463 goto finish;
38ee19c0 5464 }
fba868fa 5465
287b7376
LP		 5466 r = cant_be_in_netns();
5467 if (r < 0)
5468 goto finish;
5469
bf428efb
LP		 5470 r = initialize_rlimits();
5471 if (r < 0)
5472 goto finish;
5473
de40a303
LP		 5474 r = load_oci_bundle();
5475 if (r < 0)
5476 goto finish;
5477
f757855e
LP		 5478 r = determine_names();
5479 if (r < 0)
5480 goto finish;
5481
5482 r = load_settings();
5483 if (r < 0)
5484 goto finish;
5485
d4d99bc6 5486 r = cg_unified();
5eee8290
LP		 5487 if (r < 0) {
5488 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
5489 goto finish;
5490 }
5491
f757855e
LP		 5492 r = verify_arguments();
5493 if (r < 0)
5494 goto finish;
03cfe0d5 5495
49048684
ZJS		 5496 /* Reapply environment settings. */
5497 (void) detect_unified_cgroup_hierarchy_from_environment();
8199d554 5498
2949ff26
LP		 5499 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
5500 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
5501 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
9c274488 5502 (void) ignore_signals(SIGPIPE);
2949ff26 5503
03cfe0d5
LP		 5504 n_fd_passed = sd_listen_fds(false);
5505 if (n_fd_passed > 0) {
5506 r = fdset_new_listen_fds(&fds, false);
5507 if (r < 0) {
5508 log_error_errno(r, "Failed to collect file descriptors: %m");
5509 goto finish;
5510 }
5511 }
5512
83e803a9
ZJS		 5513 /* The "default" umask. This is appropriate for most file and directory
5514 * operations performed by nspawn, and is the umask that will be used for
5515 * the child. Functions like copy_devnodes() change the umask temporarily. */
5516 umask(0022);
5517
03cfe0d5
LP		 5518 if (arg_directory) {
5519 assert(!arg_image);
5520
b35ca61a
LP		 5521 /* Safety precaution: let's not allow running images from the live host OS image, as long as
5522 * /var from the host will propagate into container dynamically (because bad things happen if
5523 * two systems write to the same /var). Let's allow it for the special cases where /var is
5524 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
5525 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
1406bd66
LP		 5526 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5527 "Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
03cfe0d5
LP		 5528 goto finish;
5529 }
5530
5531 if (arg_ephemeral) {
5532 _cleanup_free_ char *np = NULL;
5533
f461a28d 5534 r = chase_and_update(&arg_directory, 0);
3f342ec4
LP		 5535 if (r < 0)
5536 goto finish;
5537
7bf011e3
LP		 5538 /* If the specified path is a mount point we generate the new snapshot immediately
5539 * inside it under a random name. However if the specified is not a mount point we
5540 * create the new snapshot in the parent directory, just next to it. */
e1873695 5541 r = path_is_mount_point(arg_directory, NULL, 0);
03cfe0d5
LP		 5542 if (r < 0) {
5543 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5544 goto finish;
5545 }
5546 if (r > 0)
770b5ce4 5547 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 5548 else
770b5ce4 5549 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5 5550 if (r < 0) {
0f3be6ca 5551 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
03cfe0d5
LP		 5552 goto finish;
5553 }
5554
6992459c 5555 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
162392b7 5556 * only owned by us and no one else. */
6992459c 5557 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
03cfe0d5
LP		 5558 if (r < 0) {
5559 log_error_errno(r, "Failed to lock %s: %m", np);
5560 goto finish;
5561 }
5562
7bf011e3
LP		 5563 {
5564 BLOCK_SIGNALS(SIGINT);
5565 r = btrfs_subvol_snapshot(arg_directory, np,
5566 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5567 BTRFS_SNAPSHOT_FALLBACK_COPY |
5568 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5569 BTRFS_SNAPSHOT_RECURSIVE |
5570 BTRFS_SNAPSHOT_QUOTA |
5571 BTRFS_SNAPSHOT_SIGINT);
5572 }
5573 if (r == -EINTR) {
5574 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5575 goto finish;
5576 }
03cfe0d5
LP		 5577 if (r < 0) {
5578 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5579 goto finish;
ec16945e
LP		 5580 }
5581
1cc6c93a 5582 free_and_replace(arg_directory, np);
17cbb288 5583 remove_directory = true;
30535c16 5584 } else {
f461a28d 5585 r = chase_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
8d4aa2bb
LP		 5586 if (r < 0)
5587 goto finish;
5588
30535c16
LP		 5589 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5590 if (r == -EBUSY) {
5591 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5592 goto finish;
5593 }
5594 if (r < 0) {
5595 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
476b8254 5596 goto finish;
30535c16
LP		 5597 }
5598
5599 if (arg_template) {
f461a28d 5600 r = chase_and_update(&arg_template, 0);
3f342ec4
LP		 5601 if (r < 0)
5602 goto finish;
5603
7bf011e3
LP		 5604 {
5605 BLOCK_SIGNALS(SIGINT);
5606 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5607 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5608 BTRFS_SNAPSHOT_FALLBACK_COPY |
5609 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5610 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5611 BTRFS_SNAPSHOT_RECURSIVE |
5612 BTRFS_SNAPSHOT_QUOTA |
5613 BTRFS_SNAPSHOT_SIGINT);
5614 }
ff6c6cc1
LP		 5615 if (r == -EEXIST)
5616 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5617 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
7bf011e3
LP		 5618 else if (r == -EINTR) {
5619 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5620 goto finish;
5621 } else if (r < 0) {
83521414 5622 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16 5623 goto finish;
ff6c6cc1
LP		 5624 } else
5625 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5626 "Populated %s from template %s.", arg_directory, arg_template);
30535c16 5627 }
ec16945e
LP		 5628 }
5629
7732f92b 5630 if (arg_start_mode == START_BOOT) {
aff7ae0d 5631 _cleanup_free_ char *b = NULL;
a5201ed6 5632 const char *p;
c9fe05e0 5633
aff7ae0d
LP		 5634 if (arg_pivot_root_new) {
5635 b = path_join(arg_directory, arg_pivot_root_new);
5636 if (!b)
5637 return log_oom();
5638
5639 p = b;
5640 } else
a5201ed6 5641 p = arg_directory;
c9fe05e0
AR		 5642
5643 if (path_is_os_tree(p) <= 0) {
aff7ae0d
LP		 5644 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5645 "Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
1b9e5b12
LP		 5646 goto finish;
5647 }
5648 } else {
aff7ae0d 5649 _cleanup_free_ char *p = NULL;
c9fe05e0 5650
a5201ed6 5651 if (arg_pivot_root_new)
aff7ae0d 5652 p = path_join(arg_directory, arg_pivot_root_new, "/usr/");
a5201ed6 5653 else
aff7ae0d
LP		 5654 p = path_join(arg_directory, "/usr/");
5655 if (!p)
5656 return log_oom();
1b9e5b12 5657
aff7ae0d
LP		 5658 if (laccess(p, F_OK) < 0) {
5659 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5660 "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
1b9e5b12 5661 goto finish;
1b9e5b12
LP		 5662 }
5663 }
ec16945e 5664
6b9132a9 5665 } else {
d04faa4e 5666 DissectImageFlags dissect_image_flags =
4b5de5dd 5667 DISSECT_IMAGE_GENERIC_ROOT |
d04faa4e
LP		 5668 DISSECT_IMAGE_REQUIRE_ROOT |
5669 DISSECT_IMAGE_RELAX_VAR_CHECK |
73d88b80
LP		 5670 DISSECT_IMAGE_USR_NO_ROOT |
5671 DISSECT_IMAGE_ADD_PARTITION_DEVICES |
5672 DISSECT_IMAGE_PIN_PARTITION_DEVICES;
ec16945e
LP		 5673 assert(arg_image);
5674 assert(!arg_template);
5675
f461a28d 5676 r = chase_and_update(&arg_image, 0);
3f342ec4
LP		 5677 if (r < 0)
5678 goto finish;
5679
0f3be6ca
LP		 5680 if (arg_ephemeral) {
5681 _cleanup_free_ char *np = NULL;
5682
5683 r = tempfn_random(arg_image, "machine.", &np);
5684 if (r < 0) {
5685 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5686 goto finish;
5687 }
5688
6992459c
LP		 5689 /* Always take an exclusive lock on our own ephemeral copy. */
5690 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
0f3be6ca
LP		 5691 if (r < 0) {
5692 r = log_error_errno(r, "Failed to create image lock: %m");
5693 goto finish;
5694 }
5695
7bf011e3
LP		 5696 {
5697 BLOCK_SIGNALS(SIGINT);
7c2f5495
DDM		 5698 r = copy_file_full(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600,
5699 FS_NOCOW_FL, FS_NOCOW_FL,
5700 COPY_REFLINK|COPY_CRTIME|COPY_SIGINT,
5701 NULL, NULL);
7bf011e3
LP		 5702 }
5703 if (r == -EINTR) {
5704 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5705 goto finish;
5706 }
0f3be6ca
LP		 5707 if (r < 0) {
5708 r = log_error_errno(r, "Failed to copy image file: %m");
5709 goto finish;
5710 }
5711
1cc6c93a 5712 free_and_replace(arg_image, np);
0f3be6ca
LP		 5713 remove_image = true;
5714 } else {
5715 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5716 if (r == -EBUSY) {
5717 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5718 goto finish;
5719 }
5720 if (r < 0) {
5721 r = log_error_errno(r, "Failed to create image lock: %m");
5722 goto finish;
5723 }
4623e8e6 5724
89e62e0b
LP		 5725 r = verity_settings_load(
5726 &arg_verity_settings,
5727 arg_image, NULL, NULL);
e7cbe5cb
LB		 5728 if (r < 0) {
5729 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5730 goto finish;
78ebe980 5731 }
89e62e0b
LP		 5732
5733 if (arg_verity_settings.data_path)
5734 dissect_image_flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
30535c16
LP		 5735 }
5736
c67b0082 5737 if (!mkdtemp(tmprootdir)) {
0f3be6ca 5738 r = log_error_errno(errno, "Failed to create temporary directory: %m");
6b9132a9 5739 goto finish;
1b9e5b12 5740 }
6b9132a9 5741
c67b0082
LP		 5742 remove_tmprootdir = true;
5743
5744 arg_directory = strdup(tmprootdir);
1b9e5b12
LP		 5745 if (!arg_directory) {
5746 r = log_oom();
5747 goto finish;
6b9132a9 5748 }
88213476 5749
89e62e0b
LP		 5750 r = loop_device_make_by_path(
5751 arg_image,
5752 arg_read_only ? O_RDONLY : O_RDWR,
22ee78a8 5753 /* sector_size= */ UINT32_MAX,
89e62e0b 5754 FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
7f52206a 5755 LOCK_SH,
89e62e0b 5756 &loop);
2d845785
LP		 5757 if (r < 0) {
5758 log_error_errno(r, "Failed to set up loopback block device: %m");
842f3b0f
LP		 5759 goto finish;
5760 }
1b9e5b12 5761
bad31660 5762 r = dissect_loop_device_and_warn(
bad31660 5763 loop,
89e62e0b 5764 &arg_verity_settings,
18d73705 5765 NULL,
e7cbe5cb 5766 dissect_image_flags,
e0f9e7bd 5767 &dissected_image);
2d845785 5768 if (r == -ENOPKG) {
4526113f 5769 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
2d845785
LP		 5770 log_notice("Note that the disk image needs to\n"
5771 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5772 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
db811444 5773 " c) or follow https://uapi-group.org/specifications/specs/discoverable_partitions_specification\n"
2d845785
LP		 5774 " d) or contain a file system without a partition table\n"
5775 "in order to be bootable with systemd-nspawn.");
1b9e5b12 5776 goto finish;
2d845785 5777 }
4526113f 5778 if (r < 0)
842f3b0f 5779 goto finish;
1b9e5b12 5780
88b3300f
LP		 5781 r = dissected_image_load_verity_sig_partition(
5782 dissected_image,
5783 loop->fd,
5784 &arg_verity_settings);
5785 if (r < 0)
5786 goto finish;
5787
8ee9615e
LP		 5788 if (dissected_image->has_verity && !arg_verity_settings.root_hash && !dissected_image->has_verity_sig)
5789 log_notice("Note: image %s contains verity information, but no root hash specified and no embedded "
5790 "root hash signature found! Proceeding without integrity checking.", arg_image);
4623e8e6 5791
89e62e0b
LP		 5792 r = dissected_image_decrypt_interactively(
5793 dissected_image,
5794 NULL,
5795 &arg_verity_settings,
e330f97a 5796 0);
1b9e5b12
LP		 5797 if (r < 0)
5798 goto finish;
0f3be6ca
LP		 5799
5800 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5801 if (remove_image && unlink(arg_image) >= 0)
5802 remove_image = false;
4c27749b
LP		 5803
5804 if (arg_architecture < 0)
5805 arg_architecture = dissected_image_architecture(dissected_image);
842f3b0f 5806 }
842f3b0f 5807
86c0dd4a 5808 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5a8af538
LP		 5809 if (r < 0)
5810 goto finish;
5811
de40a303
LP		 5812 if (arg_console_mode < 0)
5813 arg_console_mode =
5814 isatty(STDIN_FILENO) > 0 &&
5815 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
9c857b9d 5816
de40a303
LP		 5817 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5818 arg_quiet = true;
a258bf26 5819
9c857b9d 5820 if (!arg_quiet)
c85c2f79 5821 log_info("Spawning container %s on %s.\nPress Ctrl-] three times within 1s to kill container.",
9c857b9d
LP		 5822 arg_machine, arg_image ?: arg_directory);
5823
988851b6 5824 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, SIGRTMIN+18, -1) >= 0);
a258bf26 5825
66edd963 5826 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
03cfe0d5
LP		 5827 r = log_error_errno(errno, "Failed to become subreaper: %m");
5828 goto finish;
5829 }
5830
761cf19d
FW		 5831 if (arg_expose_ports) {
5832 r = fw_ctx_new(&fw_ctx);
5833 if (r < 0) {
5834 log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
5835 goto finish;
5836 }
5837 expose_args.fw_ctx = fw_ctx;
5838 }
d87be9b0 5839 for (;;) {
3acc84eb 5840 r = run_container(dissected_image,
44dbef90
LP		 5841 fds,
5842 veth_name, &veth_created,
761cf19d 5843 &expose_args, &master,
44dbef90 5844 &pid, &ret);
b0067625 5845 if (r <= 0)
d87be9b0 5846 break;
d87be9b0 5847 }
88213476
LP		 5848
5849finish:
04f590a4
LP		 5850 (void) sd_notify(false,
5851 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5852 "STOPPING=1\nSTATUS=Terminating...");
af4ec430 5853
9444b1f2 5854 if (pid > 0)
c67b0082 5855 (void) kill(pid, SIGKILL);
88213476 5856
503546da 5857 /* Try to flush whatever is still queued in the pty */
6a0f896b 5858 if (master >= 0) {
f5fbe71d 5859 (void) copy_bytes(master, STDOUT_FILENO, UINT64_MAX, 0);
6a0f896b
LP		 5860 master = safe_close(master);
5861 }
5862
5863 if (pid > 0)
5864 (void) wait_for_terminate(pid, NULL);
503546da 5865
50ebcf6c
LP		 5866 pager_close();
5867
17cbb288 5868 if (remove_directory && arg_directory) {
ec16945e
LP		 5869 int k;
5870
17cbb288 5871 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
ec16945e 5872 if (k < 0)
17cbb288 5873 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
ec16945e
LP		 5874 }
5875
0f3be6ca
LP		 5876 if (remove_image && arg_image) {
5877 if (unlink(arg_image) < 0)
5878 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5879 }
5880
c67b0082
LP		 5881 if (remove_tmprootdir) {
5882 if (rmdir(tmprootdir) < 0)
5883 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5884 }
5885
785890ac
LP		 5886 if (arg_machine) {
5887 const char *p;
5888
63c372cb 5889 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 5890 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 5891 }
5892
deff68e7
FW		 5893 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET, &expose_args.address4);
5894 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET6, &expose_args.address6);
7513c5b8
LP		 5895
5896 if (veth_created)
5897 (void) remove_veth_links(veth_name, arg_network_veth_extra);
22b28dfd 5898 (void) remove_bridge(arg_network_zone);
f757855e 5899
f757855e
LP		 5900 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5901 expose_port_free_all(arg_expose_ports);
bf428efb 5902 rlimit_free_all(arg_rlimit);
b2645747 5903 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
3652872a 5904 credential_free_all(arg_credentials, arg_n_credentials);
6d0b55c2 5905
44dbef90
LP		 5906 if (r < 0)
5907 return r;
5908
5909 return ret;
88213476 5910}
44dbef90
LP		 5911
5912DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.