]> git.ipfire.org Git - thirdparty/systemd.git/blame_incremental - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Merge pull request #25602 from fbuihuu/fix-TEST-73-LOCALE
[thirdparty/systemd.git] / src / nspawn / nspawn.c
... / ...
CommitLineData
1/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3#if HAVE_BLKID
4#endif
5#include <errno.h>
6#include <getopt.h>
7#include <linux/fs.h>
8#include <linux/loop.h>
9#if HAVE_SELINUX
10#include <selinux/selinux.h>
11#endif
12#include <stdlib.h>
13#include <sys/file.h>
14#include <sys/ioctl.h>
15#include <sys/personality.h>
16#include <sys/prctl.h>
17#include <sys/types.h>
18#include <sys/wait.h>
19#include <termios.h>
20#include <unistd.h>
21
22#include "sd-bus.h"
23#include "sd-daemon.h"
24#include "sd-id128.h"
25
26#include "alloc-util.h"
27#include "barrier.h"
28#include "base-filesystem.h"
29#include "blkid-util.h"
30#include "btrfs-util.h"
31#include "build.h"
32#include "bus-error.h"
33#include "bus-util.h"
34#include "cap-list.h"
35#include "capability-util.h"
36#include "cgroup-util.h"
37#include "chase-symlinks.h"
38#include "copy.h"
39#include "cpu-set-util.h"
40#include "creds-util.h"
41#include "dev-setup.h"
42#include "discover-image.h"
43#include "dissect-image.h"
44#include "env-util.h"
45#include "escape.h"
46#include "fd-util.h"
47#include "fdset.h"
48#include "fileio.h"
49#include "format-util.h"
50#include "fs-util.h"
51#include "gpt.h"
52#include "hexdecoct.h"
53#include "hostname-setup.h"
54#include "hostname-util.h"
55#include "id128-util.h"
56#include "io-util.h"
57#include "log.h"
58#include "loop-util.h"
59#include "loopback-setup.h"
60#include "macro.h"
61#include "main-func.h"
62#include "missing_sched.h"
63#include "mkdir.h"
64#include "mount-util.h"
65#include "mountpoint-util.h"
66#include "namespace-util.h"
67#include "netlink-util.h"
68#include "nspawn-bind-user.h"
69#include "nspawn-cgroup.h"
70#include "nspawn-creds.h"
71#include "nspawn-def.h"
72#include "nspawn-expose-ports.h"
73#include "nspawn-mount.h"
74#include "nspawn-network.h"
75#include "nspawn-oci.h"
76#include "nspawn-patch-uid.h"
77#include "nspawn-register.h"
78#include "nspawn-seccomp.h"
79#include "nspawn-settings.h"
80#include "nspawn-setuid.h"
81#include "nspawn-stub-pid1.h"
82#include "nspawn-util.h"
83#include "nspawn.h"
84#include "nulstr-util.h"
85#include "os-util.h"
86#include "pager.h"
87#include "parse-argument.h"
88#include "parse-util.h"
89#include "pretty-print.h"
90#include "process-util.h"
91#include "ptyfwd.h"
92#include "random-util.h"
93#include "raw-clone.h"
94#include "resolve-util.h"
95#include "rlimit-util.h"
96#include "rm-rf.h"
97#if HAVE_SECCOMP
98#include "seccomp-util.h"
99#endif
100#include "selinux-util.h"
101#include "signal-util.h"
102#include "socket-util.h"
103#include "stat-util.h"
104#include "stdio-util.h"
105#include "string-table.h"
106#include "string-util.h"
107#include "strv.h"
108#include "sysctl-util.h"
109#include "terminal-util.h"
110#include "tmpfile-util.h"
111#include "umask-util.h"
112#include "unit-name.h"
113#include "user-util.h"
114
115/* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
116#define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
117#define NSPAWN_MOUNT_TUNNEL "/run/host/incoming"
118
119#define EXIT_FORCE_RESTART 133
120
121typedef enum ContainerStatus {
122 CONTAINER_TERMINATED,
123 CONTAINER_REBOOTED,
124} ContainerStatus;
125
126static char *arg_directory = NULL;
127static char *arg_template = NULL;
128static char *arg_chdir = NULL;
129static char *arg_pivot_root_new = NULL;
130static char *arg_pivot_root_old = NULL;
131static char *arg_user = NULL;
132static uid_t arg_uid = UID_INVALID;
133static gid_t arg_gid = GID_INVALID;
134static gid_t* arg_supplementary_gids = NULL;
135static size_t arg_n_supplementary_gids = 0;
136static sd_id128_t arg_uuid = {};
137static char *arg_machine = NULL; /* The name used by the host to refer to this */
138static char *arg_hostname = NULL; /* The name the payload sees by default */
139static const char *arg_selinux_context = NULL;
140static const char *arg_selinux_apifs_context = NULL;
141static char *arg_slice = NULL;
142static bool arg_private_network = false;
143static bool arg_read_only = false;
144static StartMode arg_start_mode = START_PID1;
145static bool arg_ephemeral = false;
146static LinkJournal arg_link_journal = LINK_AUTO;
147static bool arg_link_journal_try = false;
148static uint64_t arg_caps_retain =
149 (1ULL << CAP_AUDIT_CONTROL) |
150 (1ULL << CAP_AUDIT_WRITE) |
151 (1ULL << CAP_CHOWN) |
152 (1ULL << CAP_DAC_OVERRIDE) |
153 (1ULL << CAP_DAC_READ_SEARCH) |
154 (1ULL << CAP_FOWNER) |
155 (1ULL << CAP_FSETID) |
156 (1ULL << CAP_IPC_OWNER) |
157 (1ULL << CAP_KILL) |
158 (1ULL << CAP_LEASE) |
159 (1ULL << CAP_LINUX_IMMUTABLE) |
160 (1ULL << CAP_MKNOD) |
161 (1ULL << CAP_NET_BIND_SERVICE) |
162 (1ULL << CAP_NET_BROADCAST) |
163 (1ULL << CAP_NET_RAW) |
164 (1ULL << CAP_SETFCAP) |
165 (1ULL << CAP_SETGID) |
166 (1ULL << CAP_SETPCAP) |
167 (1ULL << CAP_SETUID) |
168 (1ULL << CAP_SYS_ADMIN) |
169 (1ULL << CAP_SYS_BOOT) |
170 (1ULL << CAP_SYS_CHROOT) |
171 (1ULL << CAP_SYS_NICE) |
172 (1ULL << CAP_SYS_PTRACE) |
173 (1ULL << CAP_SYS_RESOURCE) |
174 (1ULL << CAP_SYS_TTY_CONFIG);
175static uint64_t arg_caps_ambient = 0;
176static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
177static CustomMount *arg_custom_mounts = NULL;
178static size_t arg_n_custom_mounts = 0;
179static char **arg_setenv = NULL;
180static bool arg_quiet = false;
181static bool arg_register = true;
182static bool arg_keep_unit = false;
183static char **arg_network_interfaces = NULL;
184static char **arg_network_macvlan = NULL;
185static char **arg_network_ipvlan = NULL;
186static bool arg_network_veth = false;
187static char **arg_network_veth_extra = NULL;
188static char *arg_network_bridge = NULL;
189static char *arg_network_zone = NULL;
190static char *arg_network_namespace_path = NULL;
191static PagerFlags arg_pager_flags = 0;
192static unsigned long arg_personality = PERSONALITY_INVALID;
193static char *arg_image = NULL;
194static char *arg_oci_bundle = NULL;
195static VolatileMode arg_volatile_mode = VOLATILE_NO;
196static ExposePort *arg_expose_ports = NULL;
197static char **arg_property = NULL;
198static sd_bus_message *arg_property_message = NULL;
199static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
200static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
201static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
202static int arg_kill_signal = 0;
203static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
204static SettingsMask arg_settings_mask = 0;
205static int arg_settings_trusted = -1;
206static char **arg_parameters = NULL;
207static const char *arg_container_service_name = "systemd-nspawn";
208static bool arg_notify_ready = false;
209static bool arg_use_cgns = true;
210static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
211static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
212static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
213static char **arg_syscall_allow_list = NULL;
214static char **arg_syscall_deny_list = NULL;
215#if HAVE_SECCOMP
216static scmp_filter_ctx arg_seccomp = NULL;
217#endif
218static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
219static bool arg_no_new_privileges = false;
220static int arg_oom_score_adjust = 0;
221static bool arg_oom_score_adjust_set = false;
222static CPUSet arg_cpu_set = {};
223static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
224static TimezoneMode arg_timezone = TIMEZONE_AUTO;
225static unsigned arg_console_width = UINT_MAX, arg_console_height = UINT_MAX;
226static DeviceNode* arg_extra_nodes = NULL;
227static size_t arg_n_extra_nodes = 0;
228static char **arg_sysctl = NULL;
229static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
230static Credential *arg_credentials = NULL;
231static size_t arg_n_credentials = 0;
232static char **arg_bind_user = NULL;
233static bool arg_suppress_sync = false;
234static char *arg_settings_filename = NULL;
235
236STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
237STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
238STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
239STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
240STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
241STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
242STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
243STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
244STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
245STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
246STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
247STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
248STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
249STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
250STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
251STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
252STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
253STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
254STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
255STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
256STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
257STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
258STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
259STATIC_DESTRUCTOR_REGISTER(arg_verity_settings, verity_settings_done);
260STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
261STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
262#if HAVE_SECCOMP
263STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
264#endif
265STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
266STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
267STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
268STATIC_DESTRUCTOR_REGISTER(arg_settings_filename, freep);
269
270static int handle_arg_console(const char *arg) {
271 if (streq(arg, "help")) {
272 puts("autopipe\n"
273 "interactive\n"
274 "passive\n"
275 "pipe\n"
276 "read-only");
277 return 0;
278 }
279
280 if (streq(arg, "interactive"))
281 arg_console_mode = CONSOLE_INTERACTIVE;
282 else if (streq(arg, "read-only"))
283 arg_console_mode = CONSOLE_READ_ONLY;
284 else if (streq(arg, "passive"))
285 arg_console_mode = CONSOLE_PASSIVE;
286 else if (streq(arg, "pipe")) {
287 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
288 log_full(arg_quiet ? LOG_DEBUG : LOG_NOTICE,
289 "Console mode 'pipe' selected, but standard input/output are connected to an interactive TTY. "
290 "Most likely you want to use 'interactive' console mode for proper interactivity and shell job control. "
291 "Proceeding anyway.");
292
293 arg_console_mode = CONSOLE_PIPE;
294 } else if (streq(arg, "autopipe")) {
295 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
296 arg_console_mode = CONSOLE_INTERACTIVE;
297 else
298 arg_console_mode = CONSOLE_PIPE;
299 } else
300 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
301
302 arg_settings_mask |= SETTING_CONSOLE_MODE;
303 return 1;
304}
305
306static int help(void) {
307 _cleanup_free_ char *link = NULL;
308 int r;
309
310 pager_open(arg_pager_flags);
311
312 r = terminal_urlify_man("systemd-nspawn", "1", &link);
313 if (r < 0)
314 return log_oom();
315
316 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
317 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
318 " -h --help Show this help\n"
319 " --version Print version string\n"
320 " -q --quiet Do not show status information\n"
321 " --no-pager Do not pipe output into a pager\n"
322 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
323 "%3$sImage:%4$s\n"
324 " -D --directory=PATH Root directory for the container\n"
325 " --template=PATH Initialize root directory from template directory,\n"
326 " if missing\n"
327 " -x --ephemeral Run container with snapshot of root directory, and\n"
328 " remove it after exit\n"
329 " -i --image=PATH Root file system disk image (or device node) for\n"
330 " the container\n"
331 " --oci-bundle=PATH OCI bundle directory\n"
332 " --read-only Mount the root directory read-only\n"
333 " --volatile[=MODE] Run the system in volatile mode\n"
334 " --root-hash=HASH Specify verity root hash for root disk image\n"
335 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
336 " as a DER encoded PKCS7, either as a path to a file\n"
337 " or as an ASCII base64 encoded string prefixed by\n"
338 " 'base64:'\n"
339 " --verity-data=PATH Specify hash device for verity\n"
340 " --pivot-root=PATH[:PATH]\n"
341 " Pivot root to given directory in the container\n\n"
342 "%3$sExecution:%4$s\n"
343 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
344 " -b --boot Boot up full system (i.e. invoke init)\n"
345 " --chdir=PATH Set working directory in the container\n"
346 " -E --setenv=NAME[=VALUE] Pass an environment variable to PID 1\n"
347 " -u --user=USER Run the command under specified user or UID\n"
348 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
349 " --notify-ready=BOOLEAN Receive notifications from the child init process\n"
350 " --suppress-sync=BOOLEAN\n"
351 " Suppress any form of disk data synchronization\n\n"
352 "%3$sSystem Identity:%4$s\n"
353 " -M --machine=NAME Set the machine name for the container\n"
354 " --hostname=NAME Override the hostname for the container\n"
355 " --uuid=UUID Set a specific machine UUID for the container\n\n"
356 "%3$sProperties:%4$s\n"
357 " -S --slice=SLICE Place the container in the specified slice\n"
358 " --property=NAME=VALUE Set scope unit property\n"
359 " --register=BOOLEAN Register container as machine\n"
360 " --keep-unit Do not register a scope for the machine, reuse\n"
361 " the service unit nspawn is running in\n\n"
362 "%3$sUser Namespacing:%4$s\n"
363 " --private-users=no Run without user namespacing\n"
364 " --private-users=yes|pick|identity\n"
365 " Run within user namespace, autoselect UID/GID range\n"
366 " --private-users=UIDBASE[:NUIDS]\n"
367 " Similar, but with user configured UID/GID range\n"
368 " --private-users-ownership=MODE\n"
369 " Adjust ('chown') or map ('map') OS tree ownership\n"
370 " to private UID/GID range\n"
371 " -U Equivalent to --private-users=pick and\n"
372 " --private-users-ownership=auto\n\n"
373 "%3$sNetworking:%4$s\n"
374 " --private-network Disable network in container\n"
375 " --network-interface=INTERFACE\n"
376 " Assign an existing network interface to the\n"
377 " container\n"
378 " --network-macvlan=INTERFACE\n"
379 " Create a macvlan network interface based on an\n"
380 " existing network interface to the container\n"
381 " --network-ipvlan=INTERFACE\n"
382 " Create an ipvlan network interface based on an\n"
383 " existing network interface to the container\n"
384 " -n --network-veth Add a virtual Ethernet connection between host\n"
385 " and container\n"
386 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
387 " Add an additional virtual Ethernet link between\n"
388 " host and container\n"
389 " --network-bridge=INTERFACE\n"
390 " Add a virtual Ethernet connection to the container\n"
391 " and attach it to an existing bridge on the host\n"
392 " --network-zone=NAME Similar, but attach the new interface to an\n"
393 " an automatically managed bridge interface\n"
394 " --network-namespace-path=PATH\n"
395 " Set network namespace to the one represented by\n"
396 " the specified kernel namespace file node\n"
397 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
398 " Expose a container IP port on the host\n\n"
399 "%3$sSecurity:%4$s\n"
400 " --capability=CAP In addition to the default, retain specified\n"
401 " capability\n"
402 " --drop-capability=CAP Drop the specified capability from the default set\n"
403 " --ambient-capability=CAP\n"
404 " Sets the specified capability for the started\n"
405 " process. Not useful if booting a machine.\n"
406 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
407 " --system-call-filter=LIST|~LIST\n"
408 " Permit/prohibit specific system calls\n"
409 " -Z --selinux-context=SECLABEL\n"
410 " Set the SELinux security context to be used by\n"
411 " processes in the container\n"
412 " -L --selinux-apifs-context=SECLABEL\n"
413 " Set the SELinux security context to be used by\n"
414 " API/tmpfs file systems in the container\n\n"
415 "%3$sResources:%4$s\n"
416 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
417 " --oom-score-adjust=VALUE\n"
418 " Adjust the OOM score value for the payload\n"
419 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
420 " --personality=ARCH Pick personality for this container\n\n"
421 "%3$sIntegration:%4$s\n"
422 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
423 " --timezone=MODE Select mode of /etc/localtime initialization\n"
424 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
425 " host, try-guest, try-host\n"
426 " -j Equivalent to --link-journal=try-guest\n\n"
427 "%3$sMounts:%4$s\n"
428 " --bind=PATH[:PATH[:OPTIONS]]\n"
429 " Bind mount a file or directory from the host into\n"
430 " the container\n"
431 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
432 " Similar, but creates a read-only bind mount\n"
433 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
434 " it\n"
435 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
436 " --overlay=PATH[:PATH...]:PATH\n"
437 " Create an overlay mount from the host to \n"
438 " the container\n"
439 " --overlay-ro=PATH[:PATH...]:PATH\n"
440 " Similar, but creates a read-only overlay mount\n"
441 " --bind-user=NAME Bind user from host to container\n\n"
442 "%3$sInput/Output:%4$s\n"
443 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
444 " set up for the container.\n"
445 " -P --pipe Equivalent to --console=pipe\n\n"
446 "%3$sCredentials:%4$s\n"
447 " --set-credential=ID:VALUE\n"
448 " Pass a credential with literal value to container.\n"
449 " --load-credential=ID:PATH\n"
450 " Load credential to pass to container from file or\n"
451 " AF_UNIX stream socket.\n"
452 "\nSee the %2$s for details.\n",
453 program_invocation_short_name,
454 link,
455 ansi_underline(),
456 ansi_normal(),
457 ansi_highlight(),
458 ansi_normal());
459
460 return 0;
461}
462
463static int custom_mount_check_all(void) {
464 size_t i;
465
466 for (i = 0; i < arg_n_custom_mounts; i++) {
467 CustomMount *m = &arg_custom_mounts[i];
468
469 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
470 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_OFF)
471 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
472 "--private-users-ownership=own may not be combined with custom root mounts.");
473 if (arg_uid_shift == UID_INVALID)
474 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
475 "--private-users with automatic UID shift may not be combined with custom root mounts.");
476 }
477 }
478
479 return 0;
480}
481
482static int detect_unified_cgroup_hierarchy_from_environment(void) {
483 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
484 int r;
485
486 /* Allow the user to control whether the unified hierarchy is used */
487
488 e = getenv(var);
489 if (!e) {
490 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
491 var = "UNIFIED_CGROUP_HIERARCHY";
492 e = getenv(var);
493 }
494
495 if (!isempty(e)) {
496 r = parse_boolean(e);
497 if (r < 0)
498 return log_error_errno(r, "Failed to parse $%s: %m", var);
499 if (r > 0)
500 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
501 else
502 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
503 }
504
505 return 0;
506}
507
508static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
509 int r;
510
511 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
512 * in the image actually supports. */
513 r = cg_all_unified();
514 if (r < 0)
515 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
516 if (r > 0) {
517 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
518 * routine only detects 231, so we'll have a false negative here for 230. */
519 r = systemd_installation_has_version(directory, "230");
520 if (r < 0)
521 return log_error_errno(r, "Failed to determine systemd version in container: %m");
522 if (r > 0)
523 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
524 else
525 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
526 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
527 /* Mixed cgroup hierarchy support was added in 233 */
528 r = systemd_installation_has_version(directory, "233");
529 if (r < 0)
530 return log_error_errno(r, "Failed to determine systemd version in container: %m");
531 if (r > 0)
532 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
533 else
534 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
535 } else
536 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
537
538 log_debug("Using %s hierarchy for container.",
539 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
540 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
541
542 return 0;
543}
544
545static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
546 uint64_t mask = 0;
547 int r;
548
549 for (;;) {
550 _cleanup_free_ char *t = NULL;
551
552 r = extract_first_word(&spec, &t, ",", 0);
553 if (r < 0)
554 return log_error_errno(r, "Failed to parse capability %s.", t);
555 if (r == 0)
556 break;
557
558 if (streq(t, "help")) {
559 for (int i = 0; i < capability_list_length(); i++) {
560 const char *name;
561
562 name = capability_to_name(i);
563 if (name)
564 puts(name);
565 }
566
567 return 0; /* quit */
568 }
569
570 if (streq(t, "all"))
571 mask = UINT64_MAX;
572 else {
573 r = capability_from_name(t);
574 if (r < 0)
575 return log_error_errno(r, "Failed to parse capability %s.", t);
576
577 mask |= 1ULL << r;
578 }
579 }
580
581 *ret_mask = mask;
582 return 1; /* continue */
583}
584
585static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
586 int r;
587
588 r = getenv_bool(name);
589 if (r == -ENXIO)
590 return 0;
591 if (r < 0)
592 return log_error_errno(r, "Failed to parse $%s: %m", name);
593
594 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
595 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
596 return 0;
597}
598
599static int parse_mount_settings_env(void) {
600 const char *e;
601 int r;
602
603 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
604 if (r < 0 && r != -ENXIO)
605 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
606 if (r >= 0)
607 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
608
609 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
610 if (streq_ptr(e, "network"))
611 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
612
613 else if (e) {
614 r = parse_boolean(e);
615 if (r < 0)
616 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
617
618 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
619 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
620 }
621
622 return 0;
623}
624
625static int parse_environment(void) {
626 const char *e;
627 int r;
628
629 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
630 if (r < 0)
631 return r;
632 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
633 if (r < 0)
634 return r;
635 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
636 if (r < 0)
637 return r;
638 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
639 if (r < 0)
640 return r;
641
642 r = parse_mount_settings_env();
643 if (r < 0)
644 return r;
645
646 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
647 * even if it is supported. If not supported, it has no effect. */
648 if (!cg_ns_supported())
649 arg_use_cgns = false;
650 else {
651 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
652 if (r < 0) {
653 if (r != -ENXIO)
654 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
655
656 arg_use_cgns = true;
657 } else {
658 arg_use_cgns = r > 0;
659 arg_settings_mask |= SETTING_USE_CGNS;
660 }
661 }
662
663 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
664 if (e)
665 arg_container_service_name = e;
666
667 r = getenv_bool("SYSTEMD_SUPPRESS_SYNC");
668 if (r >= 0)
669 arg_suppress_sync = r;
670 else if (r != -ENXIO)
671 log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
672
673 return detect_unified_cgroup_hierarchy_from_environment();
674}
675
676static int parse_argv(int argc, char *argv[]) {
677 enum {
678 ARG_VERSION = 0x100,
679 ARG_PRIVATE_NETWORK,
680 ARG_UUID,
681 ARG_READ_ONLY,
682 ARG_CAPABILITY,
683 ARG_AMBIENT_CAPABILITY,
684 ARG_DROP_CAPABILITY,
685 ARG_LINK_JOURNAL,
686 ARG_BIND,
687 ARG_BIND_RO,
688 ARG_TMPFS,
689 ARG_OVERLAY,
690 ARG_OVERLAY_RO,
691 ARG_INACCESSIBLE,
692 ARG_SHARE_SYSTEM,
693 ARG_REGISTER,
694 ARG_KEEP_UNIT,
695 ARG_NETWORK_INTERFACE,
696 ARG_NETWORK_MACVLAN,
697 ARG_NETWORK_IPVLAN,
698 ARG_NETWORK_BRIDGE,
699 ARG_NETWORK_ZONE,
700 ARG_NETWORK_VETH_EXTRA,
701 ARG_NETWORK_NAMESPACE_PATH,
702 ARG_PERSONALITY,
703 ARG_VOLATILE,
704 ARG_TEMPLATE,
705 ARG_PROPERTY,
706 ARG_PRIVATE_USERS,
707 ARG_KILL_SIGNAL,
708 ARG_SETTINGS,
709 ARG_CHDIR,
710 ARG_PIVOT_ROOT,
711 ARG_PRIVATE_USERS_CHOWN,
712 ARG_PRIVATE_USERS_OWNERSHIP,
713 ARG_NOTIFY_READY,
714 ARG_ROOT_HASH,
715 ARG_ROOT_HASH_SIG,
716 ARG_VERITY_DATA,
717 ARG_SYSTEM_CALL_FILTER,
718 ARG_RLIMIT,
719 ARG_HOSTNAME,
720 ARG_NO_NEW_PRIVILEGES,
721 ARG_OOM_SCORE_ADJUST,
722 ARG_CPU_AFFINITY,
723 ARG_RESOLV_CONF,
724 ARG_TIMEZONE,
725 ARG_CONSOLE,
726 ARG_PIPE,
727 ARG_OCI_BUNDLE,
728 ARG_NO_PAGER,
729 ARG_SET_CREDENTIAL,
730 ARG_LOAD_CREDENTIAL,
731 ARG_BIND_USER,
732 ARG_SUPPRESS_SYNC,
733 };
734
735 static const struct option options[] = {
736 { "help", no_argument, NULL, 'h' },
737 { "version", no_argument, NULL, ARG_VERSION },
738 { "directory", required_argument, NULL, 'D' },
739 { "template", required_argument, NULL, ARG_TEMPLATE },
740 { "ephemeral", no_argument, NULL, 'x' },
741 { "user", required_argument, NULL, 'u' },
742 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
743 { "as-pid2", no_argument, NULL, 'a' },
744 { "boot", no_argument, NULL, 'b' },
745 { "uuid", required_argument, NULL, ARG_UUID },
746 { "read-only", no_argument, NULL, ARG_READ_ONLY },
747 { "capability", required_argument, NULL, ARG_CAPABILITY },
748 { "ambient-capability", required_argument, NULL, ARG_AMBIENT_CAPABILITY },
749 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
750 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
751 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
752 { "bind", required_argument, NULL, ARG_BIND },
753 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
754 { "tmpfs", required_argument, NULL, ARG_TMPFS },
755 { "overlay", required_argument, NULL, ARG_OVERLAY },
756 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
757 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
758 { "machine", required_argument, NULL, 'M' },
759 { "hostname", required_argument, NULL, ARG_HOSTNAME },
760 { "slice", required_argument, NULL, 'S' },
761 { "setenv", required_argument, NULL, 'E' },
762 { "selinux-context", required_argument, NULL, 'Z' },
763 { "selinux-apifs-context", required_argument, NULL, 'L' },
764 { "quiet", no_argument, NULL, 'q' },
765 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
766 { "register", required_argument, NULL, ARG_REGISTER },
767 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
768 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
769 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
770 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
771 { "network-veth", no_argument, NULL, 'n' },
772 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
773 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
774 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
775 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
776 { "personality", required_argument, NULL, ARG_PERSONALITY },
777 { "image", required_argument, NULL, 'i' },
778 { "volatile", optional_argument, NULL, ARG_VOLATILE },
779 { "port", required_argument, NULL, 'p' },
780 { "property", required_argument, NULL, ARG_PROPERTY },
781 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
782 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN }, /* obsolete */
783 { "private-users-ownership",required_argument, NULL, ARG_PRIVATE_USERS_OWNERSHIP},
784 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
785 { "settings", required_argument, NULL, ARG_SETTINGS },
786 { "chdir", required_argument, NULL, ARG_CHDIR },
787 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
788 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
789 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
790 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
791 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
792 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
793 { "rlimit", required_argument, NULL, ARG_RLIMIT },
794 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
795 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
796 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
797 { "timezone", required_argument, NULL, ARG_TIMEZONE },
798 { "console", required_argument, NULL, ARG_CONSOLE },
799 { "pipe", no_argument, NULL, ARG_PIPE },
800 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
801 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
802 { "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
803 { "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
804 { "bind-user", required_argument, NULL, ARG_BIND_USER },
805 { "suppress-sync", required_argument, NULL, ARG_SUPPRESS_SYNC },
806 {}
807 };
808
809 int c, r;
810 uint64_t plus = 0, minus = 0;
811 bool mask_all_settings = false, mask_no_settings = false;
812
813 assert(argc >= 0);
814 assert(argv);
815
816 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
817 switch (c) {
818
819 case 'h':
820 return help();
821
822 case ARG_VERSION:
823 return version();
824
825 case 'D':
826 r = parse_path_argument(optarg, false, &arg_directory);
827 if (r < 0)
828 return r;
829
830 arg_settings_mask |= SETTING_DIRECTORY;
831 break;
832
833 case ARG_TEMPLATE:
834 r = parse_path_argument(optarg, false, &arg_template);
835 if (r < 0)
836 return r;
837
838 arg_settings_mask |= SETTING_DIRECTORY;
839 break;
840
841 case 'i':
842 r = parse_path_argument(optarg, false, &arg_image);
843 if (r < 0)
844 return r;
845
846 arg_settings_mask |= SETTING_DIRECTORY;
847 break;
848
849 case ARG_OCI_BUNDLE:
850 r = parse_path_argument(optarg, false, &arg_oci_bundle);
851 if (r < 0)
852 return r;
853
854 break;
855
856 case 'x':
857 arg_ephemeral = true;
858 arg_settings_mask |= SETTING_EPHEMERAL;
859 break;
860
861 case 'u':
862 r = free_and_strdup(&arg_user, optarg);
863 if (r < 0)
864 return log_oom();
865
866 arg_settings_mask |= SETTING_USER;
867 break;
868
869 case ARG_NETWORK_ZONE: {
870 char *j;
871
872 j = strjoin("vz-", optarg);
873 if (!j)
874 return log_oom();
875
876 if (!ifname_valid(j)) {
877 log_error("Network zone name not valid: %s", j);
878 free(j);
879 return -EINVAL;
880 }
881
882 free_and_replace(arg_network_zone, j);
883
884 arg_network_veth = true;
885 arg_private_network = true;
886 arg_settings_mask |= SETTING_NETWORK;
887 break;
888 }
889
890 case ARG_NETWORK_BRIDGE:
891
892 if (!ifname_valid(optarg))
893 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
894 "Bridge interface name not valid: %s", optarg);
895
896 r = free_and_strdup(&arg_network_bridge, optarg);
897 if (r < 0)
898 return log_oom();
899
900 _fallthrough_;
901 case 'n':
902 arg_network_veth = true;
903 arg_private_network = true;
904 arg_settings_mask |= SETTING_NETWORK;
905 break;
906
907 case ARG_NETWORK_VETH_EXTRA:
908 r = veth_extra_parse(&arg_network_veth_extra, optarg);
909 if (r < 0)
910 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
911
912 arg_private_network = true;
913 arg_settings_mask |= SETTING_NETWORK;
914 break;
915
916 case ARG_NETWORK_INTERFACE:
917 if (!ifname_valid(optarg))
918 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
919 "Network interface name not valid: %s", optarg);
920
921 r = test_network_interface_initialized(optarg);
922 if (r < 0)
923 return r;
924
925 if (strv_extend(&arg_network_interfaces, optarg) < 0)
926 return log_oom();
927
928 arg_private_network = true;
929 arg_settings_mask |= SETTING_NETWORK;
930 break;
931
932 case ARG_NETWORK_MACVLAN:
933
934 if (!ifname_valid(optarg))
935 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
936 "MACVLAN network interface name not valid: %s", optarg);
937
938 r = test_network_interface_initialized(optarg);
939 if (r < 0)
940 return r;
941
942 if (strv_extend(&arg_network_macvlan, optarg) < 0)
943 return log_oom();
944
945 arg_private_network = true;
946 arg_settings_mask |= SETTING_NETWORK;
947 break;
948
949 case ARG_NETWORK_IPVLAN:
950
951 if (!ifname_valid(optarg))
952 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
953 "IPVLAN network interface name not valid: %s", optarg);
954
955 r = test_network_interface_initialized(optarg);
956 if (r < 0)
957 return r;
958
959 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
960 return log_oom();
961
962 _fallthrough_;
963 case ARG_PRIVATE_NETWORK:
964 arg_private_network = true;
965 arg_settings_mask |= SETTING_NETWORK;
966 break;
967
968 case ARG_NETWORK_NAMESPACE_PATH:
969 r = parse_path_argument(optarg, false, &arg_network_namespace_path);
970 if (r < 0)
971 return r;
972
973 arg_settings_mask |= SETTING_NETWORK;
974 break;
975
976 case 'b':
977 if (arg_start_mode == START_PID2)
978 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
979 "--boot and --as-pid2 may not be combined.");
980
981 arg_start_mode = START_BOOT;
982 arg_settings_mask |= SETTING_START_MODE;
983 break;
984
985 case 'a':
986 if (arg_start_mode == START_BOOT)
987 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
988 "--boot and --as-pid2 may not be combined.");
989
990 arg_start_mode = START_PID2;
991 arg_settings_mask |= SETTING_START_MODE;
992 break;
993
994 case ARG_UUID:
995 r = sd_id128_from_string(optarg, &arg_uuid);
996 if (r < 0)
997 return log_error_errno(r, "Invalid UUID: %s", optarg);
998
999 if (sd_id128_is_null(arg_uuid))
1000 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1001 "Machine UUID may not be all zeroes.");
1002
1003 arg_settings_mask |= SETTING_MACHINE_ID;
1004 break;
1005
1006 case 'S': {
1007 _cleanup_free_ char *mangled = NULL;
1008
1009 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
1010 if (r < 0)
1011 return log_oom();
1012
1013 free_and_replace(arg_slice, mangled);
1014 arg_settings_mask |= SETTING_SLICE;
1015 break;
1016 }
1017
1018 case 'M':
1019 if (isempty(optarg))
1020 arg_machine = mfree(arg_machine);
1021 else {
1022 if (!hostname_is_valid(optarg, 0))
1023 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1024 "Invalid machine name: %s", optarg);
1025
1026 r = free_and_strdup(&arg_machine, optarg);
1027 if (r < 0)
1028 return log_oom();
1029 }
1030 break;
1031
1032 case ARG_HOSTNAME:
1033 if (isempty(optarg))
1034 arg_hostname = mfree(arg_hostname);
1035 else {
1036 if (!hostname_is_valid(optarg, 0))
1037 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1038 "Invalid hostname: %s", optarg);
1039
1040 r = free_and_strdup(&arg_hostname, optarg);
1041 if (r < 0)
1042 return log_oom();
1043 }
1044
1045 arg_settings_mask |= SETTING_HOSTNAME;
1046 break;
1047
1048 case 'Z':
1049 arg_selinux_context = optarg;
1050 break;
1051
1052 case 'L':
1053 arg_selinux_apifs_context = optarg;
1054 break;
1055
1056 case ARG_READ_ONLY:
1057 arg_read_only = true;
1058 arg_settings_mask |= SETTING_READ_ONLY;
1059 break;
1060
1061 case ARG_AMBIENT_CAPABILITY: {
1062 uint64_t m;
1063 r = parse_capability_spec(optarg, &m);
1064 if (r <= 0)
1065 return r;
1066 arg_caps_ambient |= m;
1067 arg_settings_mask |= SETTING_CAPABILITY;
1068 break;
1069 }
1070 case ARG_CAPABILITY:
1071 case ARG_DROP_CAPABILITY: {
1072 uint64_t m;
1073 r = parse_capability_spec(optarg, &m);
1074 if (r <= 0)
1075 return r;
1076
1077 if (c == ARG_CAPABILITY)
1078 plus |= m;
1079 else
1080 minus |= m;
1081 arg_settings_mask |= SETTING_CAPABILITY;
1082 break;
1083 }
1084 case ARG_NO_NEW_PRIVILEGES:
1085 r = parse_boolean(optarg);
1086 if (r < 0)
1087 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1088
1089 arg_no_new_privileges = r;
1090 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1091 break;
1092
1093 case 'j':
1094 arg_link_journal = LINK_GUEST;
1095 arg_link_journal_try = true;
1096 arg_settings_mask |= SETTING_LINK_JOURNAL;
1097 break;
1098
1099 case ARG_LINK_JOURNAL:
1100 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
1101 if (r < 0)
1102 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
1103
1104 arg_settings_mask |= SETTING_LINK_JOURNAL;
1105 break;
1106
1107 case ARG_BIND:
1108 case ARG_BIND_RO:
1109 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1110 if (r < 0)
1111 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
1112
1113 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1114 break;
1115
1116 case ARG_TMPFS:
1117 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1118 if (r < 0)
1119 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
1120
1121 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1122 break;
1123
1124 case ARG_OVERLAY:
1125 case ARG_OVERLAY_RO:
1126 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1127 if (r == -EADDRNOTAVAIL)
1128 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1129 if (r < 0)
1130 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
1131
1132 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1133 break;
1134
1135 case ARG_INACCESSIBLE:
1136 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1137 if (r < 0)
1138 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1139
1140 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1141 break;
1142
1143 case 'E':
1144 r = strv_env_replace_strdup_passthrough(&arg_setenv, optarg);
1145 if (r < 0)
1146 return log_error_errno(r, "Cannot assign environment variable %s: %m", optarg);
1147
1148 arg_settings_mask |= SETTING_ENVIRONMENT;
1149 break;
1150
1151 case 'q':
1152 arg_quiet = true;
1153 break;
1154
1155 case ARG_SHARE_SYSTEM:
1156 /* We don't officially support this anymore, except for compat reasons. People should use the
1157 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
1158 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
1159 arg_clone_ns_flags = 0;
1160 break;
1161
1162 case ARG_REGISTER:
1163 r = parse_boolean(optarg);
1164 if (r < 0) {
1165 log_error("Failed to parse --register= argument: %s", optarg);
1166 return r;
1167 }
1168
1169 arg_register = r;
1170 break;
1171
1172 case ARG_KEEP_UNIT:
1173 arg_keep_unit = true;
1174 break;
1175
1176 case ARG_PERSONALITY:
1177
1178 arg_personality = personality_from_string(optarg);
1179 if (arg_personality == PERSONALITY_INVALID)
1180 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1181 "Unknown or unsupported personality '%s'.", optarg);
1182
1183 arg_settings_mask |= SETTING_PERSONALITY;
1184 break;
1185
1186 case ARG_VOLATILE:
1187
1188 if (!optarg)
1189 arg_volatile_mode = VOLATILE_YES;
1190 else if (streq(optarg, "help")) {
1191 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1192 return 0;
1193 } else {
1194 VolatileMode m;
1195
1196 m = volatile_mode_from_string(optarg);
1197 if (m < 0)
1198 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1199 "Failed to parse --volatile= argument: %s", optarg);
1200 else
1201 arg_volatile_mode = m;
1202 }
1203
1204 arg_settings_mask |= SETTING_VOLATILE_MODE;
1205 break;
1206
1207 case 'p':
1208 r = expose_port_parse(&arg_expose_ports, optarg);
1209 if (r == -EEXIST)
1210 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1211 if (r < 0)
1212 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
1213
1214 arg_settings_mask |= SETTING_EXPOSE_PORTS;
1215 break;
1216
1217 case ARG_PROPERTY:
1218 if (strv_extend(&arg_property, optarg) < 0)
1219 return log_oom();
1220
1221 break;
1222
1223 case ARG_PRIVATE_USERS: {
1224 int boolean;
1225
1226 if (!optarg)
1227 boolean = true;
1228 else if (!in_charset(optarg, DIGITS))
1229 /* do *not* parse numbers as booleans */
1230 boolean = parse_boolean(optarg);
1231 else
1232 boolean = -1;
1233
1234 if (boolean == 0) {
1235 /* no: User namespacing off */
1236 arg_userns_mode = USER_NAMESPACE_NO;
1237 arg_uid_shift = UID_INVALID;
1238 arg_uid_range = UINT32_C(0x10000);
1239 } else if (boolean > 0) {
1240 /* yes: User namespacing on, UID range is read from root dir */
1241 arg_userns_mode = USER_NAMESPACE_FIXED;
1242 arg_uid_shift = UID_INVALID;
1243 arg_uid_range = UINT32_C(0x10000);
1244 } else if (streq(optarg, "pick")) {
1245 /* pick: User namespacing on, UID range is picked randomly */
1246 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1247 * implied by USER_NAMESPACE_PICK
1248 * further down. */
1249 arg_uid_shift = UID_INVALID;
1250 arg_uid_range = UINT32_C(0x10000);
1251
1252 } else if (streq(optarg, "identity")) {
1253 /* identity: User namespaces on, UID range is map the 0…0xFFFF range to
1254 * itself, i.e. we don't actually map anything, but do take benefit of
1255 * isolation of capability sets. */
1256 arg_userns_mode = USER_NAMESPACE_FIXED;
1257 arg_uid_shift = 0;
1258 arg_uid_range = UINT32_C(0x10000);
1259 } else {
1260 _cleanup_free_ char *buffer = NULL;
1261 const char *range, *shift;
1262
1263 /* anything else: User namespacing on, UID range is explicitly configured */
1264
1265 range = strchr(optarg, ':');
1266 if (range) {
1267 buffer = strndup(optarg, range - optarg);
1268 if (!buffer)
1269 return log_oom();
1270 shift = buffer;
1271
1272 range++;
1273 r = safe_atou32(range, &arg_uid_range);
1274 if (r < 0)
1275 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
1276 } else
1277 shift = optarg;
1278
1279 r = parse_uid(shift, &arg_uid_shift);
1280 if (r < 0)
1281 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
1282
1283 arg_userns_mode = USER_NAMESPACE_FIXED;
1284
1285 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
1286 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID range cannot be empty or go beyond " UID_FMT ".", UID_INVALID);
1287 }
1288
1289 arg_settings_mask |= SETTING_USERNS;
1290 break;
1291 }
1292
1293 case 'U':
1294 if (userns_supported()) {
1295 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1296 * implied by USER_NAMESPACE_PICK
1297 * further down. */
1298 arg_uid_shift = UID_INVALID;
1299 arg_uid_range = UINT32_C(0x10000);
1300
1301 arg_settings_mask |= SETTING_USERNS;
1302 }
1303
1304 break;
1305
1306 case ARG_PRIVATE_USERS_CHOWN:
1307 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
1308
1309 arg_settings_mask |= SETTING_USERNS;
1310 break;
1311
1312 case ARG_PRIVATE_USERS_OWNERSHIP:
1313 if (streq(optarg, "help")) {
1314 DUMP_STRING_TABLE(user_namespace_ownership, UserNamespaceOwnership, _USER_NAMESPACE_OWNERSHIP_MAX);
1315 return 0;
1316 }
1317
1318 arg_userns_ownership = user_namespace_ownership_from_string(optarg);
1319 if (arg_userns_ownership < 0)
1320 return log_error_errno(arg_userns_ownership, "Cannot parse --user-namespace-ownership= value: %s", optarg);
1321
1322 arg_settings_mask |= SETTING_USERNS;
1323 break;
1324
1325 case ARG_KILL_SIGNAL:
1326 if (streq(optarg, "help")) {
1327 DUMP_STRING_TABLE(signal, int, _NSIG);
1328 return 0;
1329 }
1330
1331 arg_kill_signal = signal_from_string(optarg);
1332 if (arg_kill_signal < 0)
1333 return log_error_errno(arg_kill_signal, "Cannot parse signal: %s", optarg);
1334
1335 arg_settings_mask |= SETTING_KILL_SIGNAL;
1336 break;
1337
1338 case ARG_SETTINGS:
1339
1340 /* no → do not read files
1341 * yes → read files, do not override cmdline, trust only subset
1342 * override → read files, override cmdline, trust only subset
1343 * trusted → read files, do not override cmdline, trust all
1344 */
1345
1346 r = parse_boolean(optarg);
1347 if (r < 0) {
1348 if (streq(optarg, "trusted")) {
1349 mask_all_settings = false;
1350 mask_no_settings = false;
1351 arg_settings_trusted = true;
1352
1353 } else if (streq(optarg, "override")) {
1354 mask_all_settings = false;
1355 mask_no_settings = true;
1356 arg_settings_trusted = -1;
1357 } else
1358 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1359 } else if (r > 0) {
1360 /* yes */
1361 mask_all_settings = false;
1362 mask_no_settings = false;
1363 arg_settings_trusted = -1;
1364 } else {
1365 /* no */
1366 mask_all_settings = true;
1367 mask_no_settings = false;
1368 arg_settings_trusted = false;
1369 }
1370
1371 break;
1372
1373 case ARG_CHDIR:
1374 if (!path_is_absolute(optarg))
1375 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1376 "Working directory %s is not an absolute path.", optarg);
1377
1378 r = free_and_strdup(&arg_chdir, optarg);
1379 if (r < 0)
1380 return log_oom();
1381
1382 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1383 break;
1384
1385 case ARG_PIVOT_ROOT:
1386 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1387 if (r < 0)
1388 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1389
1390 arg_settings_mask |= SETTING_PIVOT_ROOT;
1391 break;
1392
1393 case ARG_NOTIFY_READY:
1394 r = parse_boolean(optarg);
1395 if (r < 0)
1396 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1397 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
1398 arg_notify_ready = r;
1399 arg_settings_mask |= SETTING_NOTIFY_READY;
1400 break;
1401
1402 case ARG_ROOT_HASH: {
1403 _cleanup_free_ void *k = NULL;
1404 size_t l;
1405
1406 r = unhexmem(optarg, strlen(optarg), &k, &l);
1407 if (r < 0)
1408 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
1409 if (l < sizeof(sd_id128_t))
1410 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
1411
1412 free_and_replace(arg_verity_settings.root_hash, k);
1413 arg_verity_settings.root_hash_size = l;
1414 break;
1415 }
1416
1417 case ARG_ROOT_HASH_SIG: {
1418 char *value;
1419 size_t l;
1420 void *p;
1421
1422 if ((value = startswith(optarg, "base64:"))) {
1423 r = unbase64mem(value, strlen(value), &p, &l);
1424 if (r < 0)
1425 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1426
1427 } else {
1428 r = read_full_file(optarg, (char**) &p, &l);
1429 if (r < 0)
1430 return log_error_errno(r, "Failed parse root hash signature file '%s': %m", optarg);
1431 }
1432
1433 free_and_replace(arg_verity_settings.root_hash_sig, p);
1434 arg_verity_settings.root_hash_sig_size = l;
1435 break;
1436 }
1437
1438 case ARG_VERITY_DATA:
1439 r = parse_path_argument(optarg, false, &arg_verity_settings.data_path);
1440 if (r < 0)
1441 return r;
1442 break;
1443
1444 case ARG_SYSTEM_CALL_FILTER: {
1445 bool negative;
1446 const char *items;
1447
1448 negative = optarg[0] == '~';
1449 items = negative ? optarg + 1 : optarg;
1450
1451 for (;;) {
1452 _cleanup_free_ char *word = NULL;
1453
1454 r = extract_first_word(&items, &word, NULL, 0);
1455 if (r == 0)
1456 break;
1457 if (r == -ENOMEM)
1458 return log_oom();
1459 if (r < 0)
1460 return log_error_errno(r, "Failed to parse system call filter: %m");
1461
1462 if (negative)
1463 r = strv_extend(&arg_syscall_deny_list, word);
1464 else
1465 r = strv_extend(&arg_syscall_allow_list, word);
1466 if (r < 0)
1467 return log_oom();
1468 }
1469
1470 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1471 break;
1472 }
1473
1474 case ARG_RLIMIT: {
1475 const char *eq;
1476 _cleanup_free_ char *name = NULL;
1477 int rl;
1478
1479 if (streq(optarg, "help")) {
1480 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1481 return 0;
1482 }
1483
1484 eq = strchr(optarg, '=');
1485 if (!eq)
1486 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1487 "--rlimit= expects an '=' assignment.");
1488
1489 name = strndup(optarg, eq - optarg);
1490 if (!name)
1491 return log_oom();
1492
1493 rl = rlimit_from_string_harder(name);
1494 if (rl < 0)
1495 return log_error_errno(rl, "Unknown resource limit: %s", name);
1496
1497 if (!arg_rlimit[rl]) {
1498 arg_rlimit[rl] = new0(struct rlimit, 1);
1499 if (!arg_rlimit[rl])
1500 return log_oom();
1501 }
1502
1503 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1504 if (r < 0)
1505 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1506
1507 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1508 break;
1509 }
1510
1511 case ARG_OOM_SCORE_ADJUST:
1512 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1513 if (r < 0)
1514 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1515
1516 arg_oom_score_adjust_set = true;
1517 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1518 break;
1519
1520 case ARG_CPU_AFFINITY: {
1521 CPUSet cpuset;
1522
1523 r = parse_cpu_set(optarg, &cpuset);
1524 if (r < 0)
1525 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
1526
1527 cpu_set_reset(&arg_cpu_set);
1528 arg_cpu_set = cpuset;
1529 arg_settings_mask |= SETTING_CPU_AFFINITY;
1530 break;
1531 }
1532
1533 case ARG_RESOLV_CONF:
1534 if (streq(optarg, "help")) {
1535 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1536 return 0;
1537 }
1538
1539 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
1540 if (arg_resolv_conf < 0)
1541 return log_error_errno(arg_resolv_conf,
1542 "Failed to parse /etc/resolv.conf mode: %s", optarg);
1543
1544 arg_settings_mask |= SETTING_RESOLV_CONF;
1545 break;
1546
1547 case ARG_TIMEZONE:
1548 if (streq(optarg, "help")) {
1549 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1550 return 0;
1551 }
1552
1553 arg_timezone = timezone_mode_from_string(optarg);
1554 if (arg_timezone < 0)
1555 return log_error_errno(arg_timezone,
1556 "Failed to parse /etc/localtime mode: %s", optarg);
1557
1558 arg_settings_mask |= SETTING_TIMEZONE;
1559 break;
1560
1561 case ARG_CONSOLE:
1562 r = handle_arg_console(optarg);
1563 if (r <= 0)
1564 return r;
1565 break;
1566
1567 case 'P':
1568 case ARG_PIPE:
1569 r = handle_arg_console("pipe");
1570 if (r <= 0)
1571 return r;
1572 break;
1573
1574 case ARG_NO_PAGER:
1575 arg_pager_flags |= PAGER_DISABLE;
1576 break;
1577
1578 case ARG_SET_CREDENTIAL: {
1579 _cleanup_free_ char *word = NULL, *data = NULL;
1580 const char *p = optarg;
1581 Credential *a;
1582 ssize_t l;
1583
1584 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1585 if (r == -ENOMEM)
1586 return log_oom();
1587 if (r < 0)
1588 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1589 if (r == 0 || !p)
1590 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1591
1592 if (!credential_name_valid(word))
1593 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1594
1595 for (size_t i = 0; i < arg_n_credentials; i++)
1596 if (streq(arg_credentials[i].id, word))
1597 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1598
1599 l = cunescape(p, UNESCAPE_ACCEPT_NUL, &data);
1600 if (l < 0)
1601 return log_error_errno(l, "Failed to unescape credential data: %s", p);
1602
1603 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1604 if (!a)
1605 return log_oom();
1606
1607 a[arg_n_credentials++] = (Credential) {
1608 .id = TAKE_PTR(word),
1609 .data = TAKE_PTR(data),
1610 .size = l,
1611 };
1612
1613 arg_credentials = a;
1614
1615 arg_settings_mask |= SETTING_CREDENTIALS;
1616 break;
1617 }
1618
1619 case ARG_LOAD_CREDENTIAL: {
1620 ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
1621 _cleanup_(erase_and_freep) char *data = NULL;
1622 _cleanup_free_ char *word = NULL, *j = NULL;
1623 const char *p = optarg;
1624 Credential *a;
1625 size_t size, i;
1626
1627 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1628 if (r == -ENOMEM)
1629 return log_oom();
1630 if (r < 0)
1631 return log_error_errno(r, "Failed to parse --load-credential= parameter: %m");
1632 if (r == 0 || !p)
1633 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --load-credential=: %s", optarg);
1634
1635 if (!credential_name_valid(word))
1636 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1637
1638 for (i = 0; i < arg_n_credentials; i++)
1639 if (streq(arg_credentials[i].id, word))
1640 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1641
1642 if (path_is_absolute(p))
1643 flags |= READ_FULL_FILE_CONNECT_SOCKET;
1644 else {
1645 const char *e;
1646
1647 r = get_credentials_dir(&e);
1648 if (r < 0)
1649 return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
1650
1651 j = path_join(e, p);
1652 if (!j)
1653 return log_oom();
1654 }
1655
1656 r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
1657 flags,
1658 NULL,
1659 &data, &size);
1660 if (r < 0)
1661 return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
1662
1663 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1664 if (!a)
1665 return log_oom();
1666
1667 a[arg_n_credentials++] = (Credential) {
1668 .id = TAKE_PTR(word),
1669 .data = TAKE_PTR(data),
1670 .size = size,
1671 };
1672
1673 arg_credentials = a;
1674
1675 arg_settings_mask |= SETTING_CREDENTIALS;
1676 break;
1677 }
1678
1679 case ARG_BIND_USER:
1680 if (!valid_user_group_name(optarg, 0))
1681 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid user name to bind: %s", optarg);
1682
1683 if (strv_extend(&arg_bind_user, optarg) < 0)
1684 return log_oom();
1685
1686 arg_settings_mask |= SETTING_BIND_USER;
1687 break;
1688
1689 case ARG_SUPPRESS_SYNC:
1690 r = parse_boolean_argument("--suppress-sync=", optarg, &arg_suppress_sync);
1691 if (r < 0)
1692 return r;
1693
1694 arg_settings_mask |= SETTING_SUPPRESS_SYNC;
1695 break;
1696
1697 case '?':
1698 return -EINVAL;
1699
1700 default:
1701 assert_not_reached();
1702 }
1703
1704 if (argc > optind) {
1705 strv_free(arg_parameters);
1706 arg_parameters = strv_copy(argv + optind);
1707 if (!arg_parameters)
1708 return log_oom();
1709
1710 arg_settings_mask |= SETTING_START_MODE;
1711 }
1712
1713 if (arg_ephemeral && arg_template && !arg_directory)
1714 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1715 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1716 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1717 * --directory=". */
1718 arg_directory = TAKE_PTR(arg_template);
1719
1720 arg_caps_retain = (arg_caps_retain | plus | (arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0)) & ~minus;
1721
1722 /* Make sure to parse environment before we reset the settings mask below */
1723 r = parse_environment();
1724 if (r < 0)
1725 return r;
1726
1727 /* Load all settings from .nspawn files */
1728 if (mask_no_settings)
1729 arg_settings_mask = 0;
1730
1731 /* Don't load any settings from .nspawn files */
1732 if (mask_all_settings)
1733 arg_settings_mask = _SETTINGS_MASK_ALL;
1734
1735 return 1;
1736}
1737
1738static int verify_arguments(void) {
1739 int r;
1740
1741 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1742 /* If we are running the stub init in the container, we don't need to look at what the init
1743 * in the container supports, because we are not using it. Let's immediately pick the right
1744 * setting based on the host system configuration.
1745 *
1746 * We only do this, if the user didn't use an environment variable to override the detection.
1747 */
1748
1749 r = cg_all_unified();
1750 if (r < 0)
1751 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1752 if (r > 0)
1753 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1754 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1755 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1756 else
1757 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1758 }
1759
1760 if (arg_userns_mode != USER_NAMESPACE_NO)
1761 arg_mount_settings |= MOUNT_USE_USERNS;
1762
1763 if (arg_private_network)
1764 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1765
1766 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1767 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
1768 arg_register = false;
1769 if (arg_start_mode != START_PID1)
1770 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
1771 }
1772
1773 if (arg_userns_ownership < 0)
1774 arg_userns_ownership =
1775 arg_userns_mode == USER_NAMESPACE_PICK ? USER_NAMESPACE_OWNERSHIP_AUTO :
1776 USER_NAMESPACE_OWNERSHIP_OFF;
1777
1778 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1779 arg_kill_signal = SIGRTMIN+3;
1780
1781 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1782 arg_read_only = true;
1783
1784 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1785 arg_read_only = true;
1786
1787 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
1788 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1789 * The latter is not technically a user session, but we don't need to labour the point. */
1790 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
1791
1792 if (arg_directory && arg_image)
1793 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1794
1795 if (arg_template && arg_image)
1796 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
1797
1798 if (arg_template && !(arg_directory || arg_machine))
1799 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
1800
1801 if (arg_ephemeral && arg_template)
1802 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
1803
1804 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
1805 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
1806
1807 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
1808 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
1809
1810 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_read_only)
1811 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1812 "--read-only and --private-users-ownership=chown may not be combined.");
1813
1814 /* We don't support --private-users-ownership=chown together with any of the volatile modes since we
1815 * couldn't change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a
1816 * massive copy-up (in case of overlay) making the entire exercise pointless. */
1817 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_volatile_mode != VOLATILE_NO)
1818 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-ownership=chown may not be combined.");
1819
1820 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1821 * we need to error out, to avoid conflicts between different network options. */
1822 if (arg_network_namespace_path &&
1823 (arg_network_interfaces || arg_network_macvlan ||
1824 arg_network_ipvlan || arg_network_veth_extra ||
1825 arg_network_bridge || arg_network_zone ||
1826 arg_network_veth))
1827 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
1828
1829 if (arg_network_bridge && arg_network_zone)
1830 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1831 "--network-bridge= and --network-zone= may not be combined.");
1832
1833 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
1834 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
1835
1836 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
1837 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
1838
1839 if (arg_expose_ports && !arg_private_network)
1840 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
1841
1842 if (arg_caps_ambient) {
1843 if (arg_caps_ambient == UINT64_MAX)
1844 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= does not support the value all.");
1845
1846 if ((arg_caps_ambient & arg_caps_retain) != arg_caps_ambient)
1847 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not fully covered by Capability= setting.");
1848
1849 if (arg_start_mode == START_BOOT)
1850 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not useful for boot mode.");
1851 }
1852
1853 if (arg_userns_mode == USER_NAMESPACE_NO && !strv_isempty(arg_bind_user))
1854 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--bind-user= requires --private-users");
1855
1856 /* Drop duplicate --bind-user= entries */
1857 strv_uniq(arg_bind_user);
1858
1859 r = custom_mount_check_all();
1860 if (r < 0)
1861 return r;
1862
1863 return 0;
1864}
1865
1866int userns_lchown(const char *p, uid_t uid, gid_t gid) {
1867 assert(p);
1868
1869 if (arg_userns_mode == USER_NAMESPACE_NO)
1870 return 0;
1871
1872 if (uid == UID_INVALID && gid == GID_INVALID)
1873 return 0;
1874
1875 if (uid != UID_INVALID) {
1876 uid += arg_uid_shift;
1877
1878 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1879 return -EOVERFLOW;
1880 }
1881
1882 if (gid != GID_INVALID) {
1883 gid += (gid_t) arg_uid_shift;
1884
1885 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1886 return -EOVERFLOW;
1887 }
1888
1889 return RET_NERRNO(lchown(p, uid, gid));
1890}
1891
1892int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
1893 const char *q;
1894 int r;
1895
1896 q = prefix_roota(root, path);
1897 r = RET_NERRNO(mkdir(q, mode));
1898 if (r == -EEXIST)
1899 return 0;
1900 if (r < 0)
1901 return r;
1902
1903 return userns_lchown(q, uid, gid);
1904}
1905
1906static const char *timezone_from_path(const char *path) {
1907 return PATH_STARTSWITH_SET(
1908 path,
1909 "../usr/share/zoneinfo/",
1910 "/usr/share/zoneinfo/");
1911}
1912
1913static bool etc_writable(void) {
1914 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1915}
1916
1917static int setup_timezone(const char *dest) {
1918 _cleanup_free_ char *p = NULL, *etc = NULL;
1919 const char *where, *check;
1920 TimezoneMode m;
1921 int r;
1922
1923 assert(dest);
1924
1925 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1926 r = readlink_malloc("/etc/localtime", &p);
1927 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
1928 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1929 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
1930 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1931 else if (r < 0) {
1932 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1933 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1934 * file.
1935 *
1936 * Example:
1937 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1938 */
1939 return 0;
1940 } else if (arg_timezone == TIMEZONE_AUTO)
1941 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1942 else
1943 m = arg_timezone;
1944 } else
1945 m = arg_timezone;
1946
1947 if (m == TIMEZONE_OFF)
1948 return 0;
1949
1950 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
1951 if (r < 0) {
1952 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
1953 return 0;
1954 }
1955
1956 where = strjoina(etc, "/localtime");
1957
1958 switch (m) {
1959
1960 case TIMEZONE_DELETE:
1961 if (unlink(where) < 0)
1962 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1963
1964 return 0;
1965
1966 case TIMEZONE_SYMLINK: {
1967 _cleanup_free_ char *q = NULL;
1968 const char *z, *what;
1969
1970 z = timezone_from_path(p);
1971 if (!z) {
1972 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
1973 return 0;
1974 }
1975
1976 r = readlink_malloc(where, &q);
1977 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1978 return 0; /* Already pointing to the right place? Then do nothing .. */
1979
1980 check = strjoina(dest, "/usr/share/zoneinfo/", z);
1981 r = chase_symlinks(check, dest, 0, NULL, NULL);
1982 if (r < 0)
1983 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1984 else {
1985 if (unlink(where) < 0 && errno != ENOENT) {
1986 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1987 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1988 return 0;
1989 }
1990
1991 what = strjoina("../usr/share/zoneinfo/", z);
1992 if (symlink(what, where) < 0) {
1993 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
1994 errno, "Failed to correct timezone of container, ignoring: %m");
1995 return 0;
1996 }
1997
1998 break;
1999 }
2000
2001 _fallthrough_;
2002 }
2003
2004 case TIMEZONE_BIND: {
2005 _cleanup_free_ char *resolved = NULL;
2006 int found;
2007
2008 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
2009 if (found < 0) {
2010 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
2011 return 0;
2012 }
2013
2014 if (found == 0) /* missing? */
2015 (void) touch(resolved);
2016
2017 r = mount_nofollow_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
2018 if (r >= 0)
2019 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
2020
2021 _fallthrough_;
2022 }
2023
2024 case TIMEZONE_COPY:
2025 /* If mounting failed, try to copy */
2026 r = copy_file_atomic("/etc/localtime", where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
2027 if (r < 0) {
2028 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2029 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
2030 return 0;
2031 }
2032
2033 break;
2034
2035 default:
2036 assert_not_reached();
2037 }
2038
2039 /* Fix permissions of the symlink or file copy we just created */
2040 r = userns_lchown(where, 0, 0);
2041 if (r < 0)
2042 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
2043
2044 return 0;
2045}
2046
2047static int have_resolv_conf(const char *path) {
2048 assert(path);
2049
2050 if (access(path, F_OK) < 0) {
2051 if (errno == ENOENT)
2052 return 0;
2053
2054 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
2055 }
2056
2057 return 1;
2058}
2059
2060static int resolved_listening(void) {
2061 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2062 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2063 _cleanup_free_ char *dns_stub_listener_mode = NULL;
2064 int r;
2065
2066 /* Check if resolved is listening */
2067
2068 r = sd_bus_open_system(&bus);
2069 if (r < 0)
2070 return log_debug_errno(r, "Failed to open system bus: %m");
2071
2072 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
2073 if (r < 0)
2074 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
2075 if (r == 0)
2076 return 0;
2077
2078 r = sd_bus_get_property_string(bus,
2079 "org.freedesktop.resolve1",
2080 "/org/freedesktop/resolve1",
2081 "org.freedesktop.resolve1.Manager",
2082 "DNSStubListener",
2083 &error,
2084 &dns_stub_listener_mode);
2085 if (r < 0)
2086 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
2087
2088 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
2089}
2090
2091static int setup_resolv_conf(const char *dest) {
2092 _cleanup_free_ char *etc = NULL;
2093 const char *where, *what;
2094 ResolvConfMode m;
2095 int r;
2096
2097 assert(dest);
2098
2099 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
2100 if (arg_private_network)
2101 m = RESOLV_CONF_OFF;
2102 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
2103 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
2104 else if (have_resolv_conf("/etc/resolv.conf") > 0)
2105 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
2106 else
2107 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
2108
2109 } else
2110 m = arg_resolv_conf;
2111
2112 if (m == RESOLV_CONF_OFF)
2113 return 0;
2114
2115 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
2116 if (r < 0) {
2117 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
2118 return 0;
2119 }
2120
2121 where = strjoina(etc, "/resolv.conf");
2122
2123 if (m == RESOLV_CONF_DELETE) {
2124 if (unlink(where) < 0)
2125 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
2126
2127 return 0;
2128 }
2129
2130 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
2131 what = PRIVATE_STATIC_RESOLV_CONF;
2132 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
2133 what = PRIVATE_UPLINK_RESOLV_CONF;
2134 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
2135 what = PRIVATE_STUB_RESOLV_CONF;
2136 else
2137 what = "/etc/resolv.conf";
2138
2139 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
2140 _cleanup_free_ char *resolved = NULL;
2141 int found;
2142
2143 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
2144 if (found < 0) {
2145 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
2146 return 0;
2147 }
2148
2149 if (found == 0) /* missing? */
2150 (void) touch(resolved);
2151
2152 r = mount_nofollow_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
2153 if (r >= 0)
2154 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
2155
2156 /* If that didn't work, let's copy the file */
2157 }
2158
2159 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
2160 r = copy_file_atomic(what, where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
2161 else
2162 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, 0, 0, COPY_REFLINK);
2163 if (r < 0) {
2164 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
2165 * resolved or something similar runs inside and the symlink points there.
2166 *
2167 * If the disk image is read-only, there's also no point in complaining.
2168 */
2169 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
2170 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2171 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
2172 return 0;
2173 }
2174
2175 r = userns_lchown(where, 0, 0);
2176 if (r < 0)
2177 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
2178
2179 return 0;
2180}
2181
2182static int setup_boot_id(void) {
2183 _cleanup_(unlink_and_freep) char *from = NULL;
2184 _cleanup_free_ char *path = NULL;
2185 sd_id128_t rnd = SD_ID128_NULL;
2186 const char *to;
2187 int r;
2188
2189 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
2190
2191 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
2192 if (r < 0)
2193 return log_error_errno(r, "Failed to generate random boot ID path: %m");
2194
2195 r = sd_id128_randomize(&rnd);
2196 if (r < 0)
2197 return log_error_errno(r, "Failed to generate random boot id: %m");
2198
2199 r = id128_write(path, ID128_FORMAT_UUID, rnd);
2200 if (r < 0)
2201 return log_error_errno(r, "Failed to write boot id: %m");
2202
2203 from = TAKE_PTR(path);
2204 to = "/proc/sys/kernel/random/boot_id";
2205
2206 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
2207 if (r < 0)
2208 return r;
2209
2210 return mount_nofollow_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
2211}
2212
2213static int copy_devnodes(const char *dest) {
2214 static const char devnodes[] =
2215 "null\0"
2216 "zero\0"
2217 "full\0"
2218 "random\0"
2219 "urandom\0"
2220 "tty\0"
2221 "net/tun\0";
2222
2223 int r = 0;
2224
2225 assert(dest);
2226
2227 BLOCK_WITH_UMASK(0000);
2228
2229 /* Create /dev/net, so that we can create /dev/net/tun in it */
2230 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2231 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2232
2233 NULSTR_FOREACH(d, devnodes) {
2234 _cleanup_free_ char *from = NULL, *to = NULL;
2235 struct stat st;
2236
2237 from = path_join("/dev/", d);
2238 if (!from)
2239 return log_oom();
2240
2241 to = path_join(dest, from);
2242 if (!to)
2243 return log_oom();
2244
2245 if (stat(from, &st) < 0) {
2246
2247 if (errno != ENOENT)
2248 return log_error_errno(errno, "Failed to stat %s: %m", from);
2249
2250 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2251 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2252 "%s is not a char or block device, cannot copy.", from);
2253 else {
2254 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2255
2256 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
2257 /* Explicitly warn the user when /dev is already populated. */
2258 if (errno == EEXIST)
2259 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
2260 if (errno != EPERM)
2261 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2262
2263 /* Some systems abusively restrict mknod but allow bind mounts. */
2264 r = touch(to);
2265 if (r < 0)
2266 return log_error_errno(r, "touch (%s) failed: %m", to);
2267 r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
2268 if (r < 0)
2269 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
2270 }
2271
2272 r = userns_lchown(to, 0, 0);
2273 if (r < 0)
2274 return log_error_errno(r, "chown() of device node %s failed: %m", to);
2275
2276 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
2277 if (!dn)
2278 return log_oom();
2279
2280 r = userns_mkdir(dest, dn, 0755, 0, 0);
2281 if (r < 0)
2282 return log_error_errno(r, "Failed to create '%s': %m", dn);
2283
2284 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2285 return log_oom();
2286
2287 prefixed = path_join(dest, sl);
2288 if (!prefixed)
2289 return log_oom();
2290
2291 t = path_join("..", d);
2292 if (!t)
2293 return log_oom();
2294
2295 if (symlink(t, prefixed) < 0)
2296 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
2297 }
2298 }
2299
2300 return r;
2301}
2302
2303static int make_extra_nodes(const char *dest) {
2304 size_t i;
2305 int r;
2306
2307 BLOCK_WITH_UMASK(0000);
2308
2309 for (i = 0; i < arg_n_extra_nodes; i++) {
2310 _cleanup_free_ char *path = NULL;
2311 DeviceNode *n = arg_extra_nodes + i;
2312
2313 path = path_join(dest, n->path);
2314 if (!path)
2315 return log_oom();
2316
2317 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2318 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2319
2320 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2321 if (r < 0)
2322 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2323 }
2324
2325 return 0;
2326}
2327
2328static int setup_pts(const char *dest) {
2329 _cleanup_free_ char *options = NULL;
2330 const char *p;
2331 int r;
2332
2333#if HAVE_SELINUX
2334 if (arg_selinux_apifs_context)
2335 (void) asprintf(&options,
2336 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
2337 arg_uid_shift + TTY_GID,
2338 arg_selinux_apifs_context);
2339 else
2340#endif
2341 (void) asprintf(&options,
2342 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
2343 arg_uid_shift + TTY_GID);
2344
2345 if (!options)
2346 return log_oom();
2347
2348 /* Mount /dev/pts itself */
2349 p = prefix_roota(dest, "/dev/pts");
2350 r = RET_NERRNO(mkdir(p, 0755));
2351 if (r < 0)
2352 return log_error_errno(r, "Failed to create /dev/pts: %m");
2353
2354 r = mount_nofollow_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
2355 if (r < 0)
2356 return r;
2357 r = userns_lchown(p, 0, 0);
2358 if (r < 0)
2359 return log_error_errno(r, "Failed to chown /dev/pts: %m");
2360
2361 /* Create /dev/ptmx symlink */
2362 p = prefix_roota(dest, "/dev/ptmx");
2363 if (symlink("pts/ptmx", p) < 0)
2364 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
2365 r = userns_lchown(p, 0, 0);
2366 if (r < 0)
2367 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
2368
2369 /* And fix /dev/pts/ptmx ownership */
2370 p = prefix_roota(dest, "/dev/pts/ptmx");
2371 r = userns_lchown(p, 0, 0);
2372 if (r < 0)
2373 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
2374
2375 return 0;
2376}
2377
2378static int setup_stdio_as_dev_console(void) {
2379 _cleanup_close_ int terminal = -1;
2380 int r;
2381
2382 /* We open the TTY in O_NOCTTY mode, so that we do not become controller yet. We'll do that later
2383 * explicitly, if we are configured to. */
2384 terminal = open_terminal("/dev/console", O_RDWR|O_NOCTTY);
2385 if (terminal < 0)
2386 return log_error_errno(terminal, "Failed to open console: %m");
2387
2388 /* Make sure we can continue logging to the original stderr, even if
2389 * stderr points elsewhere now */
2390 r = log_dup_console();
2391 if (r < 0)
2392 return log_error_errno(r, "Failed to duplicate stderr: %m");
2393
2394 /* invalidates 'terminal' on success and failure */
2395 r = rearrange_stdio(terminal, terminal, terminal);
2396 TAKE_FD(terminal);
2397 if (r < 0)
2398 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2399
2400 return 0;
2401}
2402
2403static int setup_dev_console(const char *console) {
2404 _cleanup_free_ char *p = NULL;
2405 int r;
2406
2407 /* Create /dev/console symlink */
2408 r = path_make_relative("/dev", console, &p);
2409 if (r < 0)
2410 return log_error_errno(r, "Failed to create relative path: %m");
2411
2412 if (symlink(p, "/dev/console") < 0)
2413 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
2414
2415 return 0;
2416}
2417
2418static int setup_keyring(void) {
2419 key_serial_t keyring;
2420
2421 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2422 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2423 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2424 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2425 * into the container. */
2426
2427 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2428 if (keyring == -1) {
2429 if (errno == ENOSYS)
2430 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
2431 else if (ERRNO_IS_PRIVILEGE(errno))
2432 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2433 else
2434 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2435 }
2436
2437 return 0;
2438}
2439
2440static int setup_credentials(const char *root) {
2441 const char *q;
2442 int r;
2443
2444 if (arg_n_credentials <= 0)
2445 return 0;
2446
2447 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2448 if (r < 0)
2449 return log_error_errno(r, "Failed to create /run/host: %m");
2450
2451 r = userns_mkdir(root, "/run/host/credentials", 0700, 0, 0);
2452 if (r < 0)
2453 return log_error_errno(r, "Failed to create /run/host/credentials: %m");
2454
2455 q = prefix_roota(root, "/run/host/credentials");
2456 r = mount_nofollow_verbose(LOG_ERR, NULL, q, "ramfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0700");
2457 if (r < 0)
2458 return r;
2459
2460 for (size_t i = 0; i < arg_n_credentials; i++) {
2461 _cleanup_free_ char *j = NULL;
2462 _cleanup_close_ int fd = -1;
2463
2464 j = path_join(q, arg_credentials[i].id);
2465 if (!j)
2466 return log_oom();
2467
2468 fd = open(j, O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC|O_NOFOLLOW, 0600);
2469 if (fd < 0)
2470 return log_error_errno(errno, "Failed to create credential file %s: %m", j);
2471
2472 r = loop_write(fd, arg_credentials[i].data, arg_credentials[i].size, /* do_poll= */ false);
2473 if (r < 0)
2474 return log_error_errno(r, "Failed to write credential to file %s: %m", j);
2475
2476 if (fchmod(fd, 0400) < 0)
2477 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", j);
2478
2479 if (arg_userns_mode != USER_NAMESPACE_NO) {
2480 if (fchown(fd, arg_uid_shift, arg_uid_shift) < 0)
2481 return log_error_errno(errno, "Failed to adjust ownership of %s: %m", j);
2482 }
2483 }
2484
2485 if (chmod(q, 0500) < 0)
2486 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", q);
2487
2488 r = userns_lchown(q, 0, 0);
2489 if (r < 0)
2490 return r;
2491
2492 /* Make both mount and superblock read-only now */
2493 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
2494 if (r < 0)
2495 return r;
2496
2497 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0500");
2498}
2499
2500static int setup_kmsg(int fd_inner_socket) {
2501 _cleanup_(unlink_and_freep) char *from = NULL;
2502 _cleanup_free_ char *fifo = NULL;
2503 _cleanup_close_ int fd = -1;
2504 int r;
2505
2506 assert(fd_inner_socket >= 0);
2507
2508 BLOCK_WITH_UMASK(0000);
2509
2510 /* We create the kmsg FIFO as as temporary file in /run, but immediately delete it after bind mounting it to
2511 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2512 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2513 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2514
2515 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
2516 if (r < 0)
2517 return log_error_errno(r, "Failed to generate kmsg path: %m");
2518
2519 if (mkfifo(fifo, 0600) < 0)
2520 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
2521
2522 from = TAKE_PTR(fifo);
2523
2524 r = mount_nofollow_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
2525 if (r < 0)
2526 return r;
2527
2528 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
2529 if (fd < 0)
2530 return log_error_errno(errno, "Failed to open fifo: %m");
2531
2532 /* Store away the fd in the socket, so that it stays open as long as we run the child */
2533 r = send_one_fd(fd_inner_socket, fd, 0);
2534 if (r < 0)
2535 return log_error_errno(r, "Failed to send FIFO fd: %m");
2536
2537 return 0;
2538}
2539
2540struct ExposeArgs {
2541 union in_addr_union address4;
2542 union in_addr_union address6;
2543 struct FirewallContext *fw_ctx;
2544};
2545
2546static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
2547 struct ExposeArgs *args = ASSERT_PTR(userdata);
2548
2549 assert(rtnl);
2550 assert(m);
2551
2552 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
2553 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
2554 return 0;
2555}
2556
2557static int setup_hostname(void) {
2558 int r;
2559
2560 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
2561 return 0;
2562
2563 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2564 if (r < 0)
2565 return log_error_errno(r, "Failed to set hostname: %m");
2566
2567 return 0;
2568}
2569
2570static int setup_journal(const char *directory) {
2571 _cleanup_free_ char *d = NULL;
2572 const char *p, *q;
2573 sd_id128_t this_id;
2574 bool try;
2575 int r;
2576
2577 /* Don't link journals in ephemeral mode */
2578 if (arg_ephemeral)
2579 return 0;
2580
2581 if (arg_link_journal == LINK_NO)
2582 return 0;
2583
2584 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2585
2586 r = sd_id128_get_machine(&this_id);
2587 if (r < 0)
2588 return log_error_errno(r, "Failed to retrieve machine ID: %m");
2589
2590 if (sd_id128_equal(arg_uuid, this_id)) {
2591 log_full(try ? LOG_WARNING : LOG_ERR,
2592 "Host and machine ids are equal (%s): refusing to link journals", SD_ID128_TO_STRING(arg_uuid));
2593 if (try)
2594 return 0;
2595 return -EEXIST;
2596 }
2597
2598 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2599 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2600 if (r < 0) {
2601 bool ignore = r == -EROFS && try;
2602 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2603 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2604 return ignore ? 0 : r;
2605 }
2606 }
2607
2608 p = strjoina("/var/log/journal/", SD_ID128_TO_STRING(arg_uuid));
2609 q = prefix_roota(directory, p);
2610
2611 if (path_is_mount_point(p, NULL, 0) > 0) {
2612 if (try)
2613 return 0;
2614
2615 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2616 "%s: already a mount point, refusing to use for journal", p);
2617 }
2618
2619 if (path_is_mount_point(q, NULL, 0) > 0) {
2620 if (try)
2621 return 0;
2622
2623 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2624 "%s: already a mount point, refusing to use for journal", q);
2625 }
2626
2627 r = readlink_and_make_absolute(p, &d);
2628 if (r >= 0) {
2629 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
2630 path_equal(d, q)) {
2631
2632 r = userns_mkdir(directory, p, 0755, 0, 0);
2633 if (r < 0)
2634 log_warning_errno(r, "Failed to create directory %s: %m", q);
2635 return 0;
2636 }
2637
2638 if (unlink(p) < 0)
2639 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
2640 } else if (r == -EINVAL) {
2641
2642 if (arg_link_journal == LINK_GUEST &&
2643 rmdir(p) < 0) {
2644
2645 if (errno == ENOTDIR) {
2646 log_error("%s already exists and is neither a symlink nor a directory", p);
2647 return r;
2648 } else
2649 return log_error_errno(errno, "Failed to remove %s: %m", p);
2650 }
2651 } else if (r != -ENOENT)
2652 return log_error_errno(r, "readlink(%s) failed: %m", p);
2653
2654 if (arg_link_journal == LINK_GUEST) {
2655
2656 if (symlink(q, p) < 0) {
2657 if (try) {
2658 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
2659 return 0;
2660 } else
2661 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
2662 }
2663
2664 r = userns_mkdir(directory, p, 0755, 0, 0);
2665 if (r < 0)
2666 log_warning_errno(r, "Failed to create directory %s: %m", q);
2667 return 0;
2668 }
2669
2670 if (arg_link_journal == LINK_HOST) {
2671 /* don't create parents here — if the host doesn't have
2672 * permanent journal set up, don't force it here */
2673
2674 r = RET_NERRNO(mkdir(p, 0755));
2675 if (r < 0 && r != -EEXIST) {
2676 if (try) {
2677 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
2678 return 0;
2679 } else
2680 return log_error_errno(r, "Failed to create %s: %m", p);
2681 }
2682
2683 } else if (access(p, F_OK) < 0)
2684 return 0;
2685
2686 if (dir_is_empty(q, /* ignore_hidden_or_backup= */ false) == 0)
2687 log_warning("%s is not empty, proceeding anyway.", q);
2688
2689 r = userns_mkdir(directory, p, 0755, 0, 0);
2690 if (r < 0)
2691 return log_error_errno(r, "Failed to create %s: %m", q);
2692
2693 r = mount_nofollow_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
2694 if (r < 0)
2695 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
2696
2697 return 0;
2698}
2699
2700static int drop_capabilities(uid_t uid) {
2701 CapabilityQuintet q;
2702
2703 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2704 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2705 * arg_caps_retain. */
2706
2707 if (capability_quintet_is_set(&arg_full_capabilities)) {
2708 q = arg_full_capabilities;
2709
2710 if (q.bounding == UINT64_MAX)
2711 q.bounding = uid == 0 ? arg_caps_retain : 0;
2712
2713 if (q.effective == UINT64_MAX)
2714 q.effective = uid == 0 ? q.bounding : 0;
2715
2716 if (q.inheritable == UINT64_MAX)
2717 q.inheritable = uid == 0 ? q.bounding : arg_caps_ambient;
2718
2719 if (q.permitted == UINT64_MAX)
2720 q.permitted = uid == 0 ? q.bounding : arg_caps_ambient;
2721
2722 if (q.ambient == UINT64_MAX && ambient_capabilities_supported())
2723 q.ambient = arg_caps_ambient;
2724
2725 if (capability_quintet_mangle(&q))
2726 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2727
2728 } else {
2729 q = (CapabilityQuintet) {
2730 .bounding = arg_caps_retain,
2731 .effective = uid == 0 ? arg_caps_retain : 0,
2732 .inheritable = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2733 .permitted = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2734 .ambient = ambient_capabilities_supported() ? arg_caps_ambient : UINT64_MAX,
2735 };
2736
2737 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2738 * in order to maintain the same behavior as systemd < 242. */
2739 if (capability_quintet_mangle(&q))
2740 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2741 "Some capabilities will not be set because they are not in the current bounding set.");
2742
2743 }
2744
2745 return capability_quintet_enforce(&q);
2746}
2747
2748static int reset_audit_loginuid(void) {
2749 _cleanup_free_ char *p = NULL;
2750 int r;
2751
2752 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
2753 return 0;
2754
2755 r = read_one_line_file("/proc/self/loginuid", &p);
2756 if (r == -ENOENT)
2757 return 0;
2758 if (r < 0)
2759 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
2760
2761 /* Already reset? */
2762 if (streq(p, "4294967295"))
2763 return 0;
2764
2765 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
2766 if (r < 0) {
2767 log_error_errno(r,
2768 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2769 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2770 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2771 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2772 "using systemd-nspawn. Sleeping for 5s... (%m)");
2773
2774 sleep(5);
2775 }
2776
2777 return 0;
2778}
2779
2780static int mount_tunnel_dig(const char *root) {
2781 const char *p, *q;
2782 int r;
2783
2784 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2785 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
2786 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
2787 (void) mkdir_p(p, 0600);
2788
2789 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2790 if (r < 0)
2791 return log_error_errno(r, "Failed to create /run/host: %m");
2792
2793 r = userns_mkdir(root, NSPAWN_MOUNT_TUNNEL, 0600, 0, 0);
2794 if (r < 0)
2795 return log_error_errno(r, "Failed to create "NSPAWN_MOUNT_TUNNEL": %m");
2796
2797 q = prefix_roota(root, NSPAWN_MOUNT_TUNNEL);
2798 r = mount_nofollow_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
2799 if (r < 0)
2800 return r;
2801
2802 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
2803 if (r < 0)
2804 return r;
2805
2806 return 0;
2807}
2808
2809static int mount_tunnel_open(void) {
2810 int r;
2811
2812 r = mount_follow_verbose(LOG_ERR, NULL, NSPAWN_MOUNT_TUNNEL, NULL, MS_SLAVE, NULL);
2813 if (r < 0)
2814 return r;
2815
2816 return 0;
2817}
2818
2819static int setup_machine_id(const char *directory) {
2820 const char *etc_machine_id;
2821 sd_id128_t id;
2822 int r;
2823
2824 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2825 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2826 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2827 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2828 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2829 * container behaves nicely). */
2830
2831 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2832
2833 r = id128_read(etc_machine_id, ID128_FORMAT_PLAIN, &id);
2834 if (r < 0) {
2835 if (!IN_SET(r, -ENOENT, -ENOMEDIUM, -ENOPKG)) /* If the file is missing, empty, or uninitialized, we don't mind */
2836 return log_error_errno(r, "Failed to read machine ID from container image: %m");
2837
2838 if (sd_id128_is_null(arg_uuid)) {
2839 r = sd_id128_randomize(&arg_uuid);
2840 if (r < 0)
2841 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2842 }
2843 } else {
2844 if (sd_id128_is_null(id))
2845 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2846 "Machine ID in container image is zero, refusing.");
2847
2848 arg_uuid = id;
2849 }
2850
2851 return 0;
2852}
2853
2854static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2855 int r;
2856
2857 assert(directory);
2858
2859 if (arg_userns_mode == USER_NAMESPACE_NO || arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_CHOWN)
2860 return 0;
2861
2862 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2863 if (r == -EOPNOTSUPP)
2864 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2865 if (r == -EBADE)
2866 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2867 if (r < 0)
2868 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2869 if (r == 0)
2870 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2871 else
2872 log_debug("Patched directory tree to match UID/GID range.");
2873
2874 return r;
2875}
2876
2877/*
2878 * Return values:
2879 * < 0 : wait_for_terminate() failed to get the state of the
2880 * container, the container was terminated by a signal, or
2881 * failed for an unknown reason. No change is made to the
2882 * container argument.
2883 * > 0 : The program executed in the container terminated with an
2884 * error. The exit code of the program executed in the
2885 * container is returned. The container argument has been set
2886 * to CONTAINER_TERMINATED.
2887 * 0 : The container is being rebooted, has been shut down or exited
2888 * successfully. The container argument has been set to either
2889 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
2890 *
2891 * That is, success is indicated by a return value of zero, and an
2892 * error is indicated by a non-zero value.
2893 */
2894static int wait_for_container(pid_t pid, ContainerStatus *container) {
2895 siginfo_t status;
2896 int r;
2897
2898 r = wait_for_terminate(pid, &status);
2899 if (r < 0)
2900 return log_warning_errno(r, "Failed to wait for container: %m");
2901
2902 switch (status.si_code) {
2903
2904 case CLD_EXITED:
2905 if (status.si_status == 0)
2906 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
2907 else
2908 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
2909
2910 *container = CONTAINER_TERMINATED;
2911 return status.si_status;
2912
2913 case CLD_KILLED:
2914 if (status.si_status == SIGINT) {
2915 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
2916 *container = CONTAINER_TERMINATED;
2917 return 0;
2918
2919 } else if (status.si_status == SIGHUP) {
2920 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
2921 *container = CONTAINER_REBOOTED;
2922 return 0;
2923 }
2924
2925 _fallthrough_;
2926 case CLD_DUMPED:
2927 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2928 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
2929
2930 default:
2931 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2932 "Container %s failed due to unknown reason.", arg_machine);
2933 }
2934}
2935
2936static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2937 pid_t pid;
2938
2939 pid = PTR_TO_PID(userdata);
2940 if (pid > 0) {
2941 if (kill(pid, arg_kill_signal) >= 0) {
2942 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2943 sd_event_source_set_userdata(s, NULL);
2944 return 0;
2945 }
2946 }
2947
2948 sd_event_exit(sd_event_source_get_event(s), 0);
2949 return 0;
2950}
2951
2952static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
2953 pid_t pid;
2954
2955 assert(s);
2956 assert(ssi);
2957
2958 pid = PTR_TO_PID(userdata);
2959
2960 for (;;) {
2961 siginfo_t si = {};
2962
2963 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2964 return log_error_errno(errno, "Failed to waitid(): %m");
2965 if (si.si_pid == 0) /* No pending children. */
2966 break;
2967 if (si.si_pid == pid) {
2968 /* The main process we care for has exited. Return from
2969 * signal handler but leave the zombie. */
2970 sd_event_exit(sd_event_source_get_event(s), 0);
2971 break;
2972 }
2973
2974 /* Reap all other children. */
2975 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2976 }
2977
2978 return 0;
2979}
2980
2981static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2982 pid_t pid;
2983
2984 assert(m);
2985
2986 pid = PTR_TO_PID(userdata);
2987
2988 if (arg_kill_signal > 0) {
2989 log_info("Container termination requested. Attempting to halt container.");
2990 (void) kill(pid, arg_kill_signal);
2991 } else {
2992 log_info("Container termination requested. Exiting.");
2993 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
2994 }
2995
2996 return 0;
2997}
2998
2999static int determine_names(void) {
3000 int r;
3001
3002 if (arg_template && !arg_directory && arg_machine) {
3003
3004 /* If --template= was specified then we should not
3005 * search for a machine, but instead create a new one
3006 * in /var/lib/machine. */
3007
3008 arg_directory = path_join("/var/lib/machines", arg_machine);
3009 if (!arg_directory)
3010 return log_oom();
3011 }
3012
3013 if (!arg_image && !arg_directory) {
3014 if (arg_machine) {
3015 _cleanup_(image_unrefp) Image *i = NULL;
3016
3017 r = image_find(IMAGE_MACHINE, arg_machine, NULL, &i);
3018 if (r == -ENOENT)
3019 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
3020 if (r < 0)
3021 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
3022
3023 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
3024 r = free_and_strdup(&arg_image, i->path);
3025 else
3026 r = free_and_strdup(&arg_directory, i->path);
3027 if (r < 0)
3028 return log_oom();
3029
3030 if (!arg_ephemeral)
3031 arg_read_only = arg_read_only || i->read_only;
3032 } else {
3033 r = safe_getcwd(&arg_directory);
3034 if (r < 0)
3035 return log_error_errno(r, "Failed to determine current directory: %m");
3036 }
3037
3038 if (!arg_directory && !arg_image)
3039 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
3040 }
3041
3042 if (!arg_machine) {
3043 if (arg_directory && path_equal(arg_directory, "/"))
3044 arg_machine = gethostname_malloc();
3045 else if (arg_image) {
3046 char *e;
3047
3048 arg_machine = strdup(basename(arg_image));
3049
3050 /* Truncate suffix if there is one */
3051 e = endswith(arg_machine, ".raw");
3052 if (e)
3053 *e = 0;
3054 } else
3055 arg_machine = strdup(basename(arg_directory));
3056 if (!arg_machine)
3057 return log_oom();
3058
3059 hostname_cleanup(arg_machine);
3060 if (!hostname_is_valid(arg_machine, 0))
3061 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
3062
3063 /* Copy the machine name before the random suffix is added below, otherwise we won't be able
3064 * to match fixed config file names. */
3065 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3066 if (!arg_settings_filename)
3067 return log_oom();
3068
3069 /* Add a random suffix when this is an ephemeral machine, so that we can run many
3070 * instances at once without manually having to specify -M each time. */
3071 if (arg_ephemeral)
3072 if (strextendf(&arg_machine, "-%016" PRIx64, random_u64()) < 0)
3073 return log_oom();
3074 } else {
3075 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3076 if (!arg_settings_filename)
3077 return log_oom();
3078 }
3079
3080 return 0;
3081}
3082
3083static int chase_symlinks_and_update(char **p, unsigned flags) {
3084 char *chased;
3085 int r;
3086
3087 assert(p);
3088
3089 if (!*p)
3090 return 0;
3091
3092 r = chase_symlinks(*p, NULL, flags, &chased, NULL);
3093 if (r < 0)
3094 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
3095
3096 return free_and_replace(*p, chased);
3097}
3098
3099static int determine_uid_shift(const char *directory) {
3100
3101 if (arg_userns_mode == USER_NAMESPACE_NO) {
3102 arg_uid_shift = 0;
3103 return 0;
3104 }
3105
3106 if (arg_uid_shift == UID_INVALID) {
3107 struct stat st;
3108
3109 /* Read the UID shift off the image. Maybe we can reuse this to avoid chowning. */
3110
3111 if (stat(directory, &st) < 0)
3112 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
3113
3114 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
3115
3116 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
3117 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3118 "UID and GID base of %s don't match.", directory);
3119
3120 arg_uid_range = UINT32_C(0x10000);
3121
3122 if (arg_uid_shift != 0) {
3123 /* If the image is shifted already, then we'll fall back to classic chowning, for
3124 * compatibility (and simplicity), or refuse if mapping is explicitly requested. */
3125
3126 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_AUTO) {
3127 log_debug("UID base of %s is non-zero, not using UID mapping.", directory);
3128 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3129 } else if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_MAP)
3130 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3131 "UID base of %s is not zero, UID mapping not supported.", directory);
3132 }
3133 }
3134
3135 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
3136 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID base too high for UID range.");
3137
3138 return 0;
3139}
3140
3141static unsigned long effective_clone_ns_flags(void) {
3142 unsigned long flags = arg_clone_ns_flags;
3143
3144 if (arg_private_network)
3145 flags |= CLONE_NEWNET;
3146 if (arg_use_cgns)
3147 flags |= CLONE_NEWCGROUP;
3148 if (arg_userns_mode != USER_NAMESPACE_NO)
3149 flags |= CLONE_NEWUSER;
3150
3151 return flags;
3152}
3153
3154static int patch_sysctl(void) {
3155
3156 /* This table is inspired by runc's sysctl() function */
3157 static const struct {
3158 const char *key;
3159 bool prefix;
3160 unsigned long clone_flags;
3161 } safe_sysctl[] = {
3162 { "kernel.hostname", false, CLONE_NEWUTS },
3163 { "kernel.domainname", false, CLONE_NEWUTS },
3164 { "kernel.msgmax", false, CLONE_NEWIPC },
3165 { "kernel.msgmnb", false, CLONE_NEWIPC },
3166 { "kernel.msgmni", false, CLONE_NEWIPC },
3167 { "kernel.sem", false, CLONE_NEWIPC },
3168 { "kernel.shmall", false, CLONE_NEWIPC },
3169 { "kernel.shmmax", false, CLONE_NEWIPC },
3170 { "kernel.shmmni", false, CLONE_NEWIPC },
3171 { "fs.mqueue.", true, CLONE_NEWIPC },
3172 { "net.", true, CLONE_NEWNET },
3173 };
3174
3175 unsigned long flags;
3176 int r;
3177
3178 flags = effective_clone_ns_flags();
3179
3180 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
3181 bool good = false;
3182 size_t i;
3183
3184 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
3185
3186 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
3187 continue;
3188
3189 if (safe_sysctl[i].prefix)
3190 good = startswith(*k, safe_sysctl[i].key);
3191 else
3192 good = streq(*k, safe_sysctl[i].key);
3193
3194 if (good)
3195 break;
3196 }
3197
3198 if (!good)
3199 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
3200
3201 r = sysctl_write(*k, *v);
3202 if (r < 0)
3203 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
3204 }
3205
3206 return 0;
3207}
3208
3209static int inner_child(
3210 Barrier *barrier,
3211 const char *directory,
3212 bool secondary,
3213 int fd_inner_socket,
3214 FDSet *fds,
3215 char **os_release_pairs) {
3216
3217 _cleanup_free_ char *home = NULL;
3218 size_t n_env = 1;
3219 char *envp[] = {
3220 (char*) "PATH=" DEFAULT_PATH_COMPAT,
3221 NULL, /* container */
3222 NULL, /* TERM */
3223 NULL, /* HOME */
3224 NULL, /* USER */
3225 NULL, /* LOGNAME */
3226 NULL, /* container_uuid */
3227 NULL, /* LISTEN_FDS */
3228 NULL, /* LISTEN_PID */
3229 NULL, /* NOTIFY_SOCKET */
3230 NULL, /* CREDENTIALS_DIRECTORY */
3231 NULL, /* LANG */
3232 NULL
3233 };
3234 const char *exec_target;
3235 _cleanup_strv_free_ char **env_use = NULL;
3236 int r, which_failed;
3237
3238 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
3239 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
3240 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
3241 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
3242 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
3243 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
3244 * namespace.
3245 *
3246 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
3247 * unshare(). See below. */
3248
3249 assert(barrier);
3250 assert(directory);
3251 assert(fd_inner_socket >= 0);
3252
3253 log_debug("Inner child is initializing.");
3254
3255 if (arg_userns_mode != USER_NAMESPACE_NO) {
3256 /* Tell the parent, that it now can write the UID map. */
3257 (void) barrier_place(barrier); /* #1 */
3258
3259 /* Wait until the parent wrote the UID map */
3260 if (!barrier_place_and_sync(barrier)) /* #2 */
3261 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
3262
3263 /* Become the new root user inside our namespace */
3264 r = reset_uid_gid();
3265 if (r < 0)
3266 return log_error_errno(r, "Couldn't become new root: %m");
3267
3268 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
3269 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
3270 * propagation, but simply create new peer groups for all our mounts). */
3271 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
3272 if (r < 0)
3273 return r;
3274 }
3275
3276 r = mount_all(NULL,
3277 arg_mount_settings | MOUNT_IN_USERNS,
3278 arg_uid_shift,
3279 arg_selinux_apifs_context);
3280 if (r < 0)
3281 return r;
3282
3283 if (!arg_network_namespace_path && arg_private_network) {
3284 r = unshare(CLONE_NEWNET);
3285 if (r < 0)
3286 return log_error_errno(errno, "Failed to unshare network namespace: %m");
3287
3288 /* Tell the parent that it can setup network interfaces. */
3289 (void) barrier_place(barrier); /* #3 */
3290 }
3291
3292 r = mount_sysfs(NULL, arg_mount_settings);
3293 if (r < 0)
3294 return r;
3295
3296 /* Wait until we are cgroup-ified, so that we
3297 * can mount the right cgroup path writable */
3298 if (!barrier_place_and_sync(barrier)) /* #4 */
3299 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3300 "Parent died too early");
3301
3302 if (arg_use_cgns) {
3303 r = unshare(CLONE_NEWCGROUP);
3304 if (r < 0)
3305 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
3306 r = mount_cgroups(
3307 "",
3308 arg_unified_cgroup_hierarchy,
3309 arg_userns_mode != USER_NAMESPACE_NO,
3310 arg_uid_shift,
3311 arg_uid_range,
3312 arg_selinux_apifs_context,
3313 true);
3314 } else
3315 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
3316 if (r < 0)
3317 return r;
3318
3319 r = setup_boot_id();
3320 if (r < 0)
3321 return r;
3322
3323 r = setup_kmsg(fd_inner_socket);
3324 if (r < 0)
3325 return r;
3326
3327 r = mount_custom(
3328 "/",
3329 arg_custom_mounts,
3330 arg_n_custom_mounts,
3331 0,
3332 0,
3333 arg_selinux_apifs_context,
3334 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
3335 if (r < 0)
3336 return r;
3337
3338 if (setsid() < 0)
3339 return log_error_errno(errno, "setsid() failed: %m");
3340
3341 if (arg_private_network)
3342 (void) loopback_setup();
3343
3344 if (arg_expose_ports) {
3345 r = expose_port_send_rtnl(fd_inner_socket);
3346 if (r < 0)
3347 return r;
3348 }
3349
3350 if (arg_console_mode != CONSOLE_PIPE) {
3351 _cleanup_close_ int master = -1;
3352 _cleanup_free_ char *console = NULL;
3353
3354 /* Allocate a pty and make it available as /dev/console. */
3355 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3356 if (master < 0)
3357 return log_error_errno(master, "Failed to allocate a pty: %m");
3358
3359 r = setup_dev_console(console);
3360 if (r < 0)
3361 return log_error_errno(r, "Failed to set up /dev/console: %m");
3362
3363 r = send_one_fd(fd_inner_socket, master, 0);
3364 if (r < 0)
3365 return log_error_errno(r, "Failed to send master fd: %m");
3366
3367 r = setup_stdio_as_dev_console();
3368 if (r < 0)
3369 return r;
3370 }
3371
3372 r = patch_sysctl();
3373 if (r < 0)
3374 return r;
3375
3376 if (arg_oom_score_adjust_set) {
3377 r = set_oom_score_adjust(arg_oom_score_adjust);
3378 if (r < 0)
3379 return log_error_errno(r, "Failed to adjust OOM score: %m");
3380 }
3381
3382 if (arg_cpu_set.set)
3383 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
3384 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3385
3386 (void) setup_hostname();
3387
3388 if (arg_personality != PERSONALITY_INVALID) {
3389 r = safe_personality(arg_personality);
3390 if (r < 0)
3391 return log_error_errno(r, "personality() failed: %m");
3392 } else if (secondary) {
3393 r = safe_personality(PER_LINUX32);
3394 if (r < 0)
3395 return log_error_errno(r, "personality() failed: %m");
3396 }
3397
3398 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3399 if (r < 0)
3400 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3401
3402#if HAVE_SECCOMP
3403 if (arg_seccomp) {
3404
3405 if (is_seccomp_available()) {
3406
3407 r = seccomp_load(arg_seccomp);
3408 if (ERRNO_IS_SECCOMP_FATAL(r))
3409 return log_error_errno(r, "Failed to install seccomp filter: %m");
3410 if (r < 0)
3411 log_debug_errno(r, "Failed to install seccomp filter: %m");
3412 }
3413 } else
3414#endif
3415 {
3416 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
3417 if (r < 0)
3418 return r;
3419 }
3420
3421 if (arg_suppress_sync) {
3422#if HAVE_SECCOMP
3423 r = seccomp_suppress_sync();
3424 if (r < 0)
3425 log_debug_errno(r, "Failed to install sync() suppression seccomp filter, ignoring: %m");
3426#else
3427 log_debug("systemd is built without SECCOMP support. Ignoring --suppress-sync= command line option and SuppressSync= setting.");
3428#endif
3429 }
3430
3431#if HAVE_SELINUX
3432 if (arg_selinux_context)
3433 if (setexeccon(arg_selinux_context) < 0)
3434 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3435#endif
3436
3437 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3438 * if we need to later on. */
3439 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3440 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3441
3442 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3443 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids, arg_console_mode != CONSOLE_PIPE);
3444 else
3445 r = change_uid_gid(arg_user, arg_console_mode != CONSOLE_PIPE, &home);
3446 if (r < 0)
3447 return r;
3448
3449 r = drop_capabilities(getuid());
3450 if (r < 0)
3451 return log_error_errno(r, "Dropping capabilities failed: %m");
3452
3453 if (arg_no_new_privileges)
3454 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3455 return log_error_errno(errno, "Failed to disable new privileges: %m");
3456
3457 /* LXC sets container=lxc, so follow the scheme here */
3458 envp[n_env++] = strjoina("container=", arg_container_service_name);
3459
3460 envp[n_env] = strv_find_prefix(environ, "TERM=");
3461 if (envp[n_env])
3462 n_env++;
3463
3464 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
3465 if (asprintf(envp + n_env++, "HOME=%s", home ?: "/root") < 0)
3466 return log_oom();
3467
3468 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
3469 if (asprintf(envp + n_env++, "USER=%s", arg_user ?: "root") < 0 ||
3470 asprintf(envp + n_env++, "LOGNAME=%s", arg_user ? arg_user : "root") < 0)
3471 return log_oom();
3472
3473 assert(!sd_id128_is_null(arg_uuid));
3474
3475 if (asprintf(envp + n_env++, "container_uuid=%s", SD_ID128_TO_UUID_STRING(arg_uuid)) < 0)
3476 return log_oom();
3477
3478 if (fdset_size(fds) > 0) {
3479 r = fdset_cloexec(fds, false);
3480 if (r < 0)
3481 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3482
3483 if ((asprintf(envp + n_env++, "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3484 (asprintf(envp + n_env++, "LISTEN_PID=1") < 0))
3485 return log_oom();
3486 }
3487 if (asprintf(envp + n_env++, "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
3488 return log_oom();
3489
3490 if (arg_n_credentials > 0) {
3491 envp[n_env] = strdup("CREDENTIALS_DIRECTORY=/run/host/credentials");
3492 if (!envp[n_env])
3493 return log_oom();
3494 n_env++;
3495 }
3496
3497 if (arg_start_mode != START_BOOT) {
3498 envp[n_env] = strdup("LANG=" SYSTEMD_NSPAWN_LOCALE);
3499 if (!envp[n_env])
3500 return log_oom();
3501 n_env++;
3502 }
3503
3504 env_use = strv_env_merge(envp, os_release_pairs, arg_setenv);
3505 if (!env_use)
3506 return log_oom();
3507
3508 /* Let the parent know that we are ready and
3509 * wait until the parent is ready with the
3510 * setup, too... */
3511 if (!barrier_place_and_sync(barrier)) /* #5 */
3512 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
3513
3514 if (arg_chdir)
3515 if (chdir(arg_chdir) < 0)
3516 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3517
3518 if (arg_start_mode == START_PID2) {
3519 r = stub_pid1(arg_uuid);
3520 if (r < 0)
3521 return r;
3522 }
3523
3524 if (arg_console_mode != CONSOLE_PIPE) {
3525 /* So far our pty wasn't controlled by any process. Finally, it's time to change that, if we
3526 * are configured for that. Acquire it as controlling tty. */
3527 if (ioctl(STDIN_FILENO, TIOCSCTTY) < 0)
3528 return log_error_errno(errno, "Failed to acquire controlling TTY: %m");
3529 }
3530
3531 log_debug("Inner child completed, invoking payload.");
3532
3533 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3534 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3535 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
3536 log_close();
3537 log_set_open_when_needed(true);
3538
3539 (void) fdset_close_others(fds);
3540
3541 if (arg_start_mode == START_BOOT) {
3542 char **a;
3543 size_t m;
3544
3545 /* Automatically search for the init system */
3546
3547 m = strv_length(arg_parameters);
3548 a = newa(char*, m + 2);
3549 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3550 a[1 + m] = NULL;
3551
3552 FOREACH_STRING(init,
3553 "/usr/lib/systemd/systemd",
3554 "/lib/systemd/systemd",
3555 "/sbin/init") {
3556 a[0] = (char*) init;
3557 execve(a[0], a, env_use);
3558 }
3559
3560 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
3561 } else if (!strv_isempty(arg_parameters)) {
3562 const char *dollar_path;
3563
3564 exec_target = arg_parameters[0];
3565
3566 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3567 * binary. */
3568 dollar_path = strv_env_get(env_use, "PATH");
3569 if (dollar_path) {
3570 if (setenv("PATH", dollar_path, 1) < 0)
3571 return log_error_errno(errno, "Failed to update $PATH: %m");
3572 }
3573
3574 execvpe(arg_parameters[0], arg_parameters, env_use);
3575 } else {
3576 if (!arg_chdir)
3577 /* If we cannot change the directory, we'll end up in /, that is expected. */
3578 (void) chdir(home ?: "/root");
3579
3580 execle(DEFAULT_USER_SHELL, "-" DEFAULT_USER_SHELL_NAME, NULL, env_use);
3581 if (!streq(DEFAULT_USER_SHELL, "/bin/bash"))
3582 execle("/bin/bash", "-bash", NULL, env_use);
3583 if (!streq(DEFAULT_USER_SHELL, "/bin/sh"))
3584 execle("/bin/sh", "-sh", NULL, env_use);
3585
3586 exec_target = DEFAULT_USER_SHELL ", /bin/bash, /bin/sh";
3587 }
3588
3589 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
3590}
3591
3592static int setup_notify_child(void) {
3593 _cleanup_close_ int fd = -1;
3594 static const union sockaddr_union sa = {
3595 .un.sun_family = AF_UNIX,
3596 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
3597 };
3598 int r;
3599
3600 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3601 if (fd < 0)
3602 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3603
3604 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
3605 (void) sockaddr_un_unlink(&sa.un);
3606
3607 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
3608 if (r < 0)
3609 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
3610
3611 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
3612 if (r < 0)
3613 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
3614
3615 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
3616 if (r < 0)
3617 return log_error_errno(r, "SO_PASSCRED failed: %m");
3618
3619 return TAKE_FD(fd);
3620}
3621
3622static int outer_child(
3623 Barrier *barrier,
3624 const char *directory,
3625 DissectedImage *dissected_image,
3626 bool secondary,
3627 int fd_outer_socket,
3628 int fd_inner_socket,
3629 FDSet *fds,
3630 int netns_fd) {
3631
3632 _cleanup_(bind_user_context_freep) BindUserContext *bind_user_context = NULL;
3633 _cleanup_strv_free_ char **os_release_pairs = NULL;
3634 _cleanup_close_ int fd = -1, mntns_fd = -EBADF;
3635 bool idmap = false;
3636 const char *p;
3637 pid_t pid;
3638 ssize_t l;
3639 int r;
3640
3641 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It
3642 * already has its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in
3643 * the host's CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET
3644 * namespaces. After it completed a number of initializations a second child (the "inner" one) is
3645 * forked off it, and it exits. */
3646
3647 assert(barrier);
3648 assert(directory);
3649 assert(fd_outer_socket >= 0);
3650 assert(fd_inner_socket >= 0);
3651
3652 log_debug("Outer child is initializing.");
3653
3654 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3655 if (r < 0)
3656 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3657
3658 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3659 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3660
3661 r = reset_audit_loginuid();
3662 if (r < 0)
3663 return r;
3664
3665 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3666 * mounts to the real root. */
3667 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
3668 if (r < 0)
3669 return r;
3670
3671 if (dissected_image) {
3672 /* If we are operating on a disk image, then mount its root directory now, but leave out the
3673 * rest. We can read the UID shift from it if we need to. Further down we'll mount the rest,
3674 * but then with the uid shift known. That way we can mount VFAT file systems shifted to the
3675 * right place right away. This makes sure ESP partitions and userns are compatible. */
3676
3677 r = dissected_image_mount_and_warn(
3678 dissected_image,
3679 directory,
3680 arg_uid_shift,
3681 arg_uid_range,
3682 DISSECT_IMAGE_MOUNT_ROOT_ONLY|
3683 DISSECT_IMAGE_DISCARD_ON_LOOP|
3684 DISSECT_IMAGE_USR_NO_ROOT|
3685 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3686 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
3687 if (r < 0)
3688 return r;
3689 }
3690
3691 r = determine_uid_shift(directory);
3692 if (r < 0)
3693 return r;
3694
3695 if (arg_userns_mode != USER_NAMESPACE_NO) {
3696 r = namespace_open(0, NULL, &mntns_fd, NULL, NULL, NULL);
3697 if (r < 0)
3698 return log_error_errno(r, "Failed to pin outer mount namespace: %m");
3699
3700 l = send_one_fd(fd_outer_socket, mntns_fd, 0);
3701 if (l < 0)
3702 return log_error_errno(l, "Failed to send outer mount namespace fd: %m");
3703 mntns_fd = safe_close(mntns_fd);
3704
3705 /* Let the parent know which UID shift we read from the image */
3706 l = send(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
3707 if (l < 0)
3708 return log_error_errno(errno, "Failed to send UID shift: %m");
3709 if (l != sizeof(arg_uid_shift))
3710 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3711 "Short write while sending UID shift.");
3712
3713 if (arg_userns_mode == USER_NAMESPACE_PICK) {
3714 /* When we are supposed to pick the UID shift, the parent will check now whether the
3715 * UID shift we just read from the image is available. If yes, it will send the UID
3716 * shift back to us, if not it will pick a different one, and send it back to us. */
3717
3718 l = recv(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
3719 if (l < 0)
3720 return log_error_errno(errno, "Failed to recv UID shift: %m");
3721 if (l != sizeof(arg_uid_shift))
3722 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3723 "Short read while receiving UID shift.");
3724 }
3725
3726 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3727 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
3728 }
3729
3730 if (path_equal(directory, "/")) {
3731 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3732 * place, so that we can make changes to its mount structure (for example, to implement
3733 * --volatile=) without this interfering with our ability to access files such as
3734 * /etc/localtime to copy into the container. Note that we use a fixed place for this
3735 * (instead of a temporary directory, since we are living in our own mount namespace here
3736 * already, and thus don't need to be afraid of colliding with anyone else's mounts). */
3737 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3738
3739 r = mount_nofollow_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
3740 if (r < 0)
3741 return r;
3742
3743 directory = "/run/systemd/nspawn-root";
3744 }
3745
3746 r = setup_pivot_root(
3747 directory,
3748 arg_pivot_root_new,
3749 arg_pivot_root_old);
3750 if (r < 0)
3751 return r;
3752
3753 r = setup_volatile_mode(
3754 directory,
3755 arg_volatile_mode,
3756 arg_uid_shift,
3757 arg_selinux_apifs_context);
3758 if (r < 0)
3759 return r;
3760
3761 r = bind_user_prepare(
3762 directory,
3763 arg_bind_user,
3764 arg_uid_shift,
3765 arg_uid_range,
3766 &arg_custom_mounts, &arg_n_custom_mounts,
3767 &bind_user_context);
3768 if (r < 0)
3769 return r;
3770
3771 if (arg_userns_mode != USER_NAMESPACE_NO && bind_user_context) {
3772 /* Send the user maps we determined to the parent, so that it installs it in our user
3773 * namespace UID map table */
3774
3775 for (size_t i = 0; i < bind_user_context->n_data; i++) {
3776 uid_t map[] = {
3777 bind_user_context->data[i].payload_user->uid,
3778 bind_user_context->data[i].host_user->uid,
3779 (uid_t) bind_user_context->data[i].payload_group->gid,
3780 (uid_t) bind_user_context->data[i].host_group->gid,
3781 };
3782
3783 l = send(fd_outer_socket, map, sizeof(map), MSG_NOSIGNAL);
3784 if (l < 0)
3785 return log_error_errno(errno, "Failed to send user UID map: %m");
3786 if (l != sizeof(map))
3787 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3788 "Short write while sending user UID map.");
3789 }
3790 }
3791
3792 r = mount_custom(
3793 directory,
3794 arg_custom_mounts,
3795 arg_n_custom_mounts,
3796 arg_uid_shift,
3797 arg_uid_range,
3798 arg_selinux_apifs_context,
3799 MOUNT_ROOT_ONLY);
3800 if (r < 0)
3801 return r;
3802
3803 /* Make sure we always have a mount that we can move to root later on. */
3804 r = make_mount_point(directory);
3805 if (r < 0)
3806 return r;
3807
3808 if (arg_userns_mode != USER_NAMESPACE_NO &&
3809 IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
3810 arg_uid_shift != 0) {
3811
3812 r = remount_idmap(directory, arg_uid_shift, arg_uid_range, UID_INVALID, REMOUNT_IDMAPPING_HOST_ROOT);
3813 if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) {
3814 /* This might fail because the kernel or file system doesn't support idmapping. We
3815 * can't really distinguish this nicely, nor do we have any guarantees about the
3816 * error codes we see, could be EOPNOTSUPP or EINVAL. */
3817 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_AUTO)
3818 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3819 "ID mapped mounts are apparently not available, sorry.");
3820
3821 log_debug("ID mapped mounts are apparently not available on this kernel or for the selected file system, reverting to recursive chown()ing.");
3822 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3823 } else if (r < 0)
3824 return log_error_errno(r, "Failed to set up ID mapped mounts: %m");
3825 else {
3826 log_debug("ID mapped mounts available, making use of them.");
3827 idmap = true;
3828 }
3829 }
3830
3831 if (dissected_image) {
3832 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
3833 r = dissected_image_mount(
3834 dissected_image,
3835 directory,
3836 arg_uid_shift,
3837 arg_uid_range,
3838 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|
3839 DISSECT_IMAGE_DISCARD_ON_LOOP|
3840 DISSECT_IMAGE_USR_NO_ROOT|
3841 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3842 (idmap ? DISSECT_IMAGE_MOUNT_IDMAPPED : 0));
3843 if (r == -EUCLEAN)
3844 return log_error_errno(r, "File system check for image failed: %m");
3845 if (r < 0)
3846 return log_error_errno(r, "Failed to mount image file system: %m");
3847 }
3848
3849 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3850 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3851
3852 r = detect_unified_cgroup_hierarchy_from_image(directory);
3853 if (r < 0)
3854 return r;
3855
3856 l = send(fd_outer_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
3857 if (l < 0)
3858 return log_error_errno(errno, "Failed to send cgroup mode: %m");
3859 if (l != sizeof(arg_unified_cgroup_hierarchy))
3860 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3861 "Short write while sending cgroup mode.");
3862 }
3863
3864 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3865 if (r < 0)
3866 return r;
3867
3868 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3869 if (r < 0)
3870 return r;
3871
3872 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3873 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
3874 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
3875 if (r < 0)
3876 return log_error_errno(r, "Failed to make tree read-only: %m");
3877 }
3878
3879 r = mount_all(directory,
3880 arg_mount_settings,
3881 arg_uid_shift,
3882 arg_selinux_apifs_context);
3883 if (r < 0)
3884 return r;
3885
3886 r = copy_devnodes(directory);
3887 if (r < 0)
3888 return r;
3889
3890 r = make_extra_nodes(directory);
3891 if (r < 0)
3892 return r;
3893
3894 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
3895
3896 p = prefix_roota(directory, "/run/host");
3897 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
3898
3899 r = setup_pts(directory);
3900 if (r < 0)
3901 return r;
3902
3903 r = mount_tunnel_dig(directory);
3904 if (r < 0)
3905 return r;
3906
3907 r = setup_keyring();
3908 if (r < 0)
3909 return r;
3910
3911 r = setup_credentials(directory);
3912 if (r < 0)
3913 return r;
3914
3915 r = bind_user_setup(bind_user_context, directory);
3916 if (r < 0)
3917 return r;
3918
3919 r = mount_custom(
3920 directory,
3921 arg_custom_mounts,
3922 arg_n_custom_mounts,
3923 arg_uid_shift,
3924 arg_uid_range,
3925 arg_selinux_apifs_context,
3926 MOUNT_NON_ROOT_ONLY);
3927 if (r < 0)
3928 return r;
3929
3930 r = setup_timezone(directory);
3931 if (r < 0)
3932 return r;
3933
3934 r = setup_resolv_conf(directory);
3935 if (r < 0)
3936 return r;
3937
3938 r = setup_machine_id(directory);
3939 if (r < 0)
3940 return r;
3941
3942 r = setup_journal(directory);
3943 if (r < 0)
3944 return r;
3945
3946 /* The same stuff as the $container env var, but nicely readable for the entire payload */
3947 p = prefix_roota(directory, "/run/host/container-manager");
3948 (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE);
3949
3950 /* The same stuff as the $container_uuid env var */
3951 p = prefix_roota(directory, "/run/host/container-uuid");
3952 (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
3953
3954 if (!arg_use_cgns) {
3955 r = mount_cgroups(
3956 directory,
3957 arg_unified_cgroup_hierarchy,
3958 arg_userns_mode != USER_NAMESPACE_NO,
3959 arg_uid_shift,
3960 arg_uid_range,
3961 arg_selinux_apifs_context,
3962 false);
3963 if (r < 0)
3964 return r;
3965 }
3966
3967 /* Mark everything as shared so our mounts get propagated down. This is required to make new bind
3968 * mounts available in systemd services inside the container that create a new mount namespace. See
3969 * https://github.com/systemd/systemd/issues/3860 Further submounts (such as /dev) done after this
3970 * will inherit the shared propagation mode.
3971 *
3972 * IMPORTANT: Do not overmount the root directory anymore from now on to enable moving the root
3973 * directory mount to root later on.
3974 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3975 */
3976 r = mount_switch_root(directory, MOUNT_ATTR_PROPAGATION_SHARED);
3977 if (r < 0)
3978 return log_error_errno(r, "Failed to move root directory: %m");
3979
3980 /* We finished setting up the rootfs which is a shared mount. The mount tunnel needs to be a
3981 * dependent mount otherwise we can't MS_MOVE mounts that were propagated from the host into
3982 * the container. */
3983 r = mount_tunnel_open();
3984 if (r < 0)
3985 return r;
3986
3987 if (arg_userns_mode != USER_NAMESPACE_NO) {
3988 /* In order to mount procfs and sysfs in an unprivileged container the kernel
3989 * requires that a fully visible instance is already present in the target mount
3990 * namespace. Mount one here so the inner child can mount its own instances. Later
3991 * we umount the temporary instances created here before we actually exec the
3992 * payload. Since the rootfs is shared the umount will propagate into the container.
3993 * Note, the inner child wouldn't be able to unmount the instances on its own since
3994 * it doesn't own the originating mount namespace. IOW, the outer child needs to do
3995 * this. */
3996 r = pin_fully_visible_fs();
3997 if (r < 0)
3998 return r;
3999 }
4000
4001 fd = setup_notify_child();
4002 if (fd < 0)
4003 return fd;
4004
4005 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
4006 arg_clone_ns_flags |
4007 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
4008 if (pid < 0)
4009 return log_error_errno(errno, "Failed to fork inner child: %m");
4010 if (pid == 0) {
4011 fd_outer_socket = safe_close(fd_outer_socket);
4012
4013 /* The inner child has all namespaces that are requested, so that we all are owned by the
4014 * user if user namespaces are turned on. */
4015
4016 if (arg_network_namespace_path) {
4017 r = namespace_enter(-1, -1, netns_fd, -1, -1);
4018 if (r < 0)
4019 return log_error_errno(r, "Failed to join network namespace: %m");
4020 }
4021
4022 r = inner_child(barrier, directory, secondary, fd_inner_socket, fds, os_release_pairs);
4023 if (r < 0)
4024 _exit(EXIT_FAILURE);
4025
4026 _exit(EXIT_SUCCESS);
4027 }
4028
4029 l = send(fd_outer_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
4030 if (l < 0)
4031 return log_error_errno(errno, "Failed to send PID: %m");
4032 if (l != sizeof(pid))
4033 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4034 "Short write while sending PID.");
4035
4036 l = send(fd_outer_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
4037 if (l < 0)
4038 return log_error_errno(errno, "Failed to send machine ID: %m");
4039 if (l != sizeof(arg_uuid))
4040 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4041 "Short write while sending machine ID.");
4042
4043 l = send_one_fd(fd_outer_socket, fd, 0);
4044 if (l < 0)
4045 return log_error_errno(l, "Failed to send notify fd: %m");
4046
4047 fd_outer_socket = safe_close(fd_outer_socket);
4048 fd_inner_socket = safe_close(fd_inner_socket);
4049 netns_fd = safe_close(netns_fd);
4050
4051 return 0;
4052}
4053
4054static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
4055 bool tried_hashed = false;
4056 unsigned n_tries = 100;
4057 uid_t candidate;
4058 int r;
4059
4060 assert(shift);
4061 assert(ret_lock_file);
4062 assert(arg_userns_mode == USER_NAMESPACE_PICK);
4063 assert(arg_uid_range == 0x10000U);
4064
4065 candidate = *shift;
4066
4067 (void) mkdir("/run/systemd/nspawn-uid", 0755);
4068
4069 for (;;) {
4070 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
4071 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
4072
4073 if (--n_tries <= 0)
4074 return -EBUSY;
4075
4076 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
4077 goto next;
4078 if ((candidate & UINT32_C(0xFFFF)) != 0)
4079 goto next;
4080
4081 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
4082 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
4083 if (r == -EBUSY) /* Range already taken by another nspawn instance */
4084 goto next;
4085 if (r < 0)
4086 return r;
4087
4088 /* Make some superficial checks whether the range is currently known in the user database */
4089 if (getpwuid(candidate))
4090 goto next;
4091 if (getpwuid(candidate + UINT32_C(0xFFFE)))
4092 goto next;
4093 if (getgrgid(candidate))
4094 goto next;
4095 if (getgrgid(candidate + UINT32_C(0xFFFE)))
4096 goto next;
4097
4098 *ret_lock_file = lf;
4099 lf = (struct LockFile) LOCK_FILE_INIT;
4100 *shift = candidate;
4101 return 0;
4102
4103 next:
4104 if (arg_machine && !tried_hashed) {
4105 /* Try to hash the base from the container name */
4106
4107 static const uint8_t hash_key[] = {
4108 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
4109 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
4110 };
4111
4112 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
4113
4114 tried_hashed = true;
4115 } else
4116 random_bytes(&candidate, sizeof(candidate));
4117
4118 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
4119 candidate &= (uid_t) UINT32_C(0xFFFF0000);
4120 }
4121}
4122
4123static int add_one_uid_map(
4124 char **p,
4125 uid_t container_uid,
4126 uid_t host_uid,
4127 uid_t range) {
4128
4129 return strextendf(p,
4130 UID_FMT " " UID_FMT " " UID_FMT "\n",
4131 container_uid, host_uid, range);
4132}
4133
4134static int make_uid_map_string(
4135 const uid_t bind_user_uid[],
4136 size_t n_bind_user_uid,
4137 size_t offset,
4138 char **ret) {
4139
4140 _cleanup_free_ char *s = NULL;
4141 uid_t previous_uid = 0;
4142 int r;
4143
4144 assert(n_bind_user_uid == 0 || bind_user_uid);
4145 assert(IN_SET(offset, 0, 2)); /* used to switch between UID and GID map */
4146 assert(ret);
4147
4148 /* The bind_user_uid[] array is a series of 4 uid_t values, for each --bind-user= entry one
4149 * quadruplet, consisting of host and container UID + GID. */
4150
4151 for (size_t i = 0; i < n_bind_user_uid; i++) {
4152 uid_t payload_uid = bind_user_uid[i*4+offset],
4153 host_uid = bind_user_uid[i*4+offset+1];
4154
4155 assert(previous_uid <= payload_uid);
4156 assert(payload_uid < arg_uid_range);
4157
4158 /* Add a range to close the gap to previous entry */
4159 if (payload_uid > previous_uid) {
4160 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, payload_uid - previous_uid);
4161 if (r < 0)
4162 return r;
4163 }
4164
4165 /* Map this specific user */
4166 r = add_one_uid_map(&s, payload_uid, host_uid, 1);
4167 if (r < 0)
4168 return r;
4169
4170 previous_uid = payload_uid + 1;
4171 }
4172
4173 /* And add a range to close the gap to finish the range */
4174 if (arg_uid_range > previous_uid) {
4175 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, arg_uid_range - previous_uid);
4176 if (r < 0)
4177 return r;
4178 }
4179
4180 assert(s);
4181
4182 *ret = TAKE_PTR(s);
4183 return 0;
4184}
4185
4186static int setup_uid_map(
4187 pid_t pid,
4188 const uid_t bind_user_uid[],
4189 size_t n_bind_user_uid) {
4190
4191 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1];
4192 _cleanup_free_ char *s = NULL;
4193 int r;
4194
4195 assert(pid > 1);
4196
4197 /* Build the UID map string */
4198 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 0, &s) < 0) /* offset=0 contains the UID pair */
4199 return log_oom();
4200
4201 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
4202 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
4203 if (r < 0)
4204 return log_error_errno(r, "Failed to write UID map: %m");
4205
4206 /* And now build the GID map string */
4207 s = mfree(s);
4208 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 2, &s) < 0) /* offset=2 contains the GID pair */
4209 return log_oom();
4210
4211 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
4212 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
4213 if (r < 0)
4214 return log_error_errno(r, "Failed to write GID map: %m");
4215
4216 return 0;
4217}
4218
4219static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
4220 char buf[NOTIFY_BUFFER_MAX+1];
4221 char *p = NULL;
4222 struct iovec iovec = {
4223 .iov_base = buf,
4224 .iov_len = sizeof(buf)-1,
4225 };
4226 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
4227 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
4228 struct msghdr msghdr = {
4229 .msg_iov = &iovec,
4230 .msg_iovlen = 1,
4231 .msg_control = &control,
4232 .msg_controllen = sizeof(control),
4233 };
4234 struct ucred *ucred;
4235 ssize_t n;
4236 pid_t inner_child_pid;
4237 _cleanup_strv_free_ char **tags = NULL;
4238 int r;
4239
4240 assert(userdata);
4241
4242 inner_child_pid = PTR_TO_PID(userdata);
4243
4244 if (revents != EPOLLIN) {
4245 log_warning("Got unexpected poll event for notify fd.");
4246 return 0;
4247 }
4248
4249 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
4250 if (n < 0) {
4251 if (ERRNO_IS_TRANSIENT(n))
4252 return 0;
4253 if (n == -EXFULL) {
4254 log_warning("Got message with truncated control data (too many fds sent?), ignoring.");
4255 return 0;
4256 }
4257 return log_warning_errno(n, "Couldn't read notification socket: %m");
4258 }
4259
4260 cmsg_close_all(&msghdr);
4261
4262 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
4263 if (!ucred || ucred->pid != inner_child_pid) {
4264 log_debug("Received notify message without valid credentials. Ignoring.");
4265 return 0;
4266 }
4267
4268 if ((size_t) n >= sizeof(buf)) {
4269 log_warning("Received notify message exceeded maximum size. Ignoring.");
4270 return 0;
4271 }
4272
4273 buf[n] = 0;
4274 tags = strv_split(buf, "\n\r");
4275 if (!tags)
4276 return log_oom();
4277
4278 if (strv_contains(tags, "READY=1")) {
4279 r = sd_notify(false, "READY=1\n");
4280 if (r < 0)
4281 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
4282 }
4283
4284 p = strv_find_startswith(tags, "STATUS=");
4285 if (p)
4286 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
4287
4288 return 0;
4289}
4290
4291static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
4292 int r;
4293
4294 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
4295 if (r < 0)
4296 return log_error_errno(r, "Failed to allocate notify event source: %m");
4297
4298 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
4299
4300 return 0;
4301}
4302
4303static int merge_settings(Settings *settings, const char *path) {
4304 int rl;
4305
4306 assert(settings);
4307 assert(path);
4308
4309 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
4310 * that this steals the fields of the Settings* structure, and hence modifies it. */
4311
4312 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
4313 settings->start_mode >= 0) {
4314 arg_start_mode = settings->start_mode;
4315 strv_free_and_replace(arg_parameters, settings->parameters);
4316 }
4317
4318 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
4319 settings->ephemeral >= 0)
4320 arg_ephemeral = settings->ephemeral;
4321
4322 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
4323 settings->root) {
4324
4325 if (!arg_settings_trusted)
4326 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
4327 else
4328 free_and_replace(arg_directory, settings->root);
4329 }
4330
4331 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
4332 settings->pivot_root_new) {
4333 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
4334 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
4335 }
4336
4337 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
4338 settings->working_directory)
4339 free_and_replace(arg_chdir, settings->working_directory);
4340
4341 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
4342 settings->environment)
4343 strv_free_and_replace(arg_setenv, settings->environment);
4344
4345 if ((arg_settings_mask & SETTING_USER) == 0) {
4346
4347 if (settings->user)
4348 free_and_replace(arg_user, settings->user);
4349
4350 if (uid_is_valid(settings->uid))
4351 arg_uid = settings->uid;
4352 if (gid_is_valid(settings->gid))
4353 arg_gid = settings->gid;
4354 if (settings->n_supplementary_gids > 0) {
4355 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
4356 arg_n_supplementary_gids = settings->n_supplementary_gids;
4357 }
4358 }
4359
4360 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
4361 uint64_t plus, minus;
4362 uint64_t network_minus = 0;
4363 uint64_t ambient;
4364
4365 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
4366 * Settings structure */
4367
4368 plus = settings->capability;
4369 minus = settings->drop_capability;
4370
4371 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4372 settings_network_configured(settings)) {
4373 if (settings_private_network(settings))
4374 plus |= UINT64_C(1) << CAP_NET_ADMIN;
4375 else
4376 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
4377 }
4378
4379 if (!arg_settings_trusted && plus != 0) {
4380 if (settings->capability != 0)
4381 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
4382 } else {
4383 arg_caps_retain &= ~network_minus;
4384 arg_caps_retain |= plus;
4385 }
4386
4387 arg_caps_retain &= ~minus;
4388
4389 /* Copy the full capabilities over too */
4390 if (capability_quintet_is_set(&settings->full_capabilities)) {
4391 if (!arg_settings_trusted)
4392 log_warning("Ignoring capability settings, file %s is not trusted.", path);
4393 else
4394 arg_full_capabilities = settings->full_capabilities;
4395 }
4396
4397 ambient = settings->ambient_capability;
4398 if (!arg_settings_trusted && ambient != 0)
4399 log_warning("Ignoring AmbientCapability= setting, file %s is not trusted.", path);
4400 else
4401 arg_caps_ambient |= ambient;
4402 }
4403
4404 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
4405 settings->kill_signal > 0)
4406 arg_kill_signal = settings->kill_signal;
4407
4408 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
4409 settings->personality != PERSONALITY_INVALID)
4410 arg_personality = settings->personality;
4411
4412 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
4413 !sd_id128_is_null(settings->machine_id)) {
4414
4415 if (!arg_settings_trusted)
4416 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
4417 else
4418 arg_uuid = settings->machine_id;
4419 }
4420
4421 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
4422 settings->read_only >= 0)
4423 arg_read_only = settings->read_only;
4424
4425 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
4426 settings->volatile_mode != _VOLATILE_MODE_INVALID)
4427 arg_volatile_mode = settings->volatile_mode;
4428
4429 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
4430 settings->n_custom_mounts > 0) {
4431
4432 if (!arg_settings_trusted)
4433 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
4434 else {
4435 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
4436 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
4437 arg_n_custom_mounts = settings->n_custom_mounts;
4438 settings->n_custom_mounts = 0;
4439 }
4440 }
4441
4442 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4443 settings_network_configured(settings)) {
4444
4445 if (!arg_settings_trusted)
4446 log_warning("Ignoring network settings, file %s is not trusted.", path);
4447 else {
4448 arg_network_veth = settings_network_veth(settings);
4449 arg_private_network = settings_private_network(settings);
4450
4451 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
4452 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
4453 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
4454 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
4455
4456 free_and_replace(arg_network_bridge, settings->network_bridge);
4457 free_and_replace(arg_network_zone, settings->network_zone);
4458
4459 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
4460 }
4461 }
4462
4463 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
4464 settings->expose_ports) {
4465
4466 if (!arg_settings_trusted)
4467 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
4468 else {
4469 expose_port_free_all(arg_expose_ports);
4470 arg_expose_ports = TAKE_PTR(settings->expose_ports);
4471 }
4472 }
4473
4474 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
4475 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
4476
4477 if (!arg_settings_trusted)
4478 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
4479 else {
4480 arg_userns_mode = settings->userns_mode;
4481 arg_uid_shift = settings->uid_shift;
4482 arg_uid_range = settings->uid_range;
4483 arg_userns_ownership = settings->userns_ownership;
4484 }
4485 }
4486
4487 if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
4488 !strv_isempty(settings->bind_user))
4489 strv_free_and_replace(arg_bind_user, settings->bind_user);
4490
4491 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
4492 settings->notify_ready >= 0)
4493 arg_notify_ready = settings->notify_ready;
4494
4495 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
4496
4497 if (!strv_isempty(settings->syscall_allow_list) || !strv_isempty(settings->syscall_deny_list)) {
4498 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
4499 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
4500 else {
4501 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4502 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
4503 }
4504 }
4505
4506#if HAVE_SECCOMP
4507 if (settings->seccomp) {
4508 if (!arg_settings_trusted)
4509 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4510 else {
4511 seccomp_release(arg_seccomp);
4512 arg_seccomp = TAKE_PTR(settings->seccomp);
4513 }
4514 }
4515#endif
4516 }
4517
4518 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4519 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4520 continue;
4521
4522 if (!settings->rlimit[rl])
4523 continue;
4524
4525 if (!arg_settings_trusted) {
4526 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
4527 continue;
4528 }
4529
4530 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4531 }
4532
4533 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4534 settings->hostname)
4535 free_and_replace(arg_hostname, settings->hostname);
4536
4537 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4538 settings->no_new_privileges >= 0)
4539 arg_no_new_privileges = settings->no_new_privileges;
4540
4541 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4542 settings->oom_score_adjust_set) {
4543
4544 if (!arg_settings_trusted)
4545 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
4546 else {
4547 arg_oom_score_adjust = settings->oom_score_adjust;
4548 arg_oom_score_adjust_set = true;
4549 }
4550 }
4551
4552 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
4553 settings->cpu_set.set) {
4554
4555 if (!arg_settings_trusted)
4556 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
4557 else {
4558 cpu_set_reset(&arg_cpu_set);
4559 arg_cpu_set = settings->cpu_set;
4560 settings->cpu_set = (CPUSet) {};
4561 }
4562 }
4563
4564 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4565 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4566 arg_resolv_conf = settings->resolv_conf;
4567
4568 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4569 settings->link_journal != _LINK_JOURNAL_INVALID) {
4570
4571 if (!arg_settings_trusted)
4572 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4573 else {
4574 arg_link_journal = settings->link_journal;
4575 arg_link_journal_try = settings->link_journal_try;
4576 }
4577 }
4578
4579 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4580 settings->timezone != _TIMEZONE_MODE_INVALID)
4581 arg_timezone = settings->timezone;
4582
4583 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4584 settings->slice) {
4585
4586 if (!arg_settings_trusted)
4587 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4588 else
4589 free_and_replace(arg_slice, settings->slice);
4590 }
4591
4592 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4593 settings->use_cgns >= 0) {
4594
4595 if (!arg_settings_trusted)
4596 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4597 else
4598 arg_use_cgns = settings->use_cgns;
4599 }
4600
4601 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
4602 settings->clone_ns_flags != ULONG_MAX) {
4603
4604 if (!arg_settings_trusted)
4605 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4606 else
4607 arg_clone_ns_flags = settings->clone_ns_flags;
4608 }
4609
4610 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4611 settings->console_mode >= 0) {
4612
4613 if (!arg_settings_trusted)
4614 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4615 else
4616 arg_console_mode = settings->console_mode;
4617 }
4618
4619 if ((arg_settings_mask & SETTING_SUPPRESS_SYNC) == 0 &&
4620 settings->suppress_sync >= 0)
4621 arg_suppress_sync = settings->suppress_sync;
4622
4623 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4624 * don't consult arg_settings_mask for them. */
4625
4626 sd_bus_message_unref(arg_property_message);
4627 arg_property_message = TAKE_PTR(settings->properties);
4628
4629 arg_console_width = settings->console_width;
4630 arg_console_height = settings->console_height;
4631
4632 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
4633 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4634 arg_n_extra_nodes = settings->n_extra_nodes;
4635
4636 return 0;
4637}
4638
4639static int load_settings(void) {
4640 _cleanup_(settings_freep) Settings *settings = NULL;
4641 _cleanup_fclose_ FILE *f = NULL;
4642 _cleanup_free_ char *p = NULL;
4643 int r;
4644
4645 if (arg_oci_bundle)
4646 return 0;
4647
4648 /* If all settings are masked, there's no point in looking for
4649 * the settings file */
4650 if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
4651 return 0;
4652
4653 /* We first look in the admin's directories in /etc and /run */
4654 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4655 _cleanup_free_ char *j = NULL;
4656
4657 j = path_join(i, arg_settings_filename);
4658 if (!j)
4659 return log_oom();
4660
4661 f = fopen(j, "re");
4662 if (f) {
4663 p = TAKE_PTR(j);
4664
4665 /* By default, we trust configuration from /etc and /run */
4666 if (arg_settings_trusted < 0)
4667 arg_settings_trusted = true;
4668
4669 break;
4670 }
4671
4672 if (errno != ENOENT)
4673 return log_error_errno(errno, "Failed to open %s: %m", j);
4674 }
4675
4676 if (!f) {
4677 /* After that, let's look for a file next to the
4678 * actual image we shall boot. */
4679
4680 if (arg_image) {
4681 p = file_in_same_dir(arg_image, arg_settings_filename);
4682 if (!p)
4683 return log_oom();
4684 } else if (arg_directory && !path_equal(arg_directory, "/")) {
4685 p = file_in_same_dir(arg_directory, arg_settings_filename);
4686 if (!p)
4687 return log_oom();
4688 }
4689
4690 if (p) {
4691 f = fopen(p, "re");
4692 if (!f && errno != ENOENT)
4693 return log_error_errno(errno, "Failed to open %s: %m", p);
4694
4695 /* By default, we do not trust configuration from /var/lib/machines */
4696 if (arg_settings_trusted < 0)
4697 arg_settings_trusted = false;
4698 }
4699 }
4700
4701 if (!f)
4702 return 0;
4703
4704 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4705
4706 r = settings_load(f, p, &settings);
4707 if (r < 0)
4708 return r;
4709
4710 return merge_settings(settings, p);
4711}
4712
4713static int load_oci_bundle(void) {
4714 _cleanup_(settings_freep) Settings *settings = NULL;
4715 int r;
4716
4717 if (!arg_oci_bundle)
4718 return 0;
4719
4720 /* By default let's trust OCI bundles */
4721 if (arg_settings_trusted < 0)
4722 arg_settings_trusted = true;
4723
4724 r = oci_load(NULL, arg_oci_bundle, &settings);
4725 if (r < 0)
4726 return r;
4727
4728 return merge_settings(settings, arg_oci_bundle);
4729}
4730
4731static int run_container(
4732 DissectedImage *dissected_image,
4733 bool secondary,
4734 FDSet *fds,
4735 char veth_name[IFNAMSIZ], bool *veth_created,
4736 struct ExposeArgs *expose_args,
4737 int *master, pid_t *pid, int *ret) {
4738
4739 static const struct sigaction sa = {
4740 .sa_handler = nop_signal_handler,
4741 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
4742 };
4743
4744 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
4745 _cleanup_close_ int etc_passwd_lock = -1;
4746 _cleanup_close_pair_ int
4747 fd_inner_socket_pair[2] = { -EBADF, -EBADF },
4748 fd_outer_socket_pair[2] = { -EBADF, -EBADF };
4749
4750 _cleanup_close_ int notify_socket = -1, mntns_fd = -EBADF, fd_kmsg_fifo = -EBADF;
4751 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
4752 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
4753 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4754 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4755 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
4756 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
4757 _cleanup_free_ uid_t *bind_user_uid = NULL;
4758 size_t n_bind_user_uid = 0;
4759 ContainerStatus container_status = 0;
4760 int ifi = 0, r;
4761 ssize_t l;
4762 sigset_t mask_chld;
4763 _cleanup_close_ int child_netns_fd = -1;
4764
4765 assert_se(sigemptyset(&mask_chld) == 0);
4766 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4767
4768 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4769 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4770 * check with getpwuid() if the specific user already exists. Note that /etc might be
4771 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4772 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4773 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4774 * really ours. */
4775
4776 etc_passwd_lock = take_etc_passwd_lock(NULL);
4777 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4778 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4779 }
4780
4781 r = barrier_create(&barrier);
4782 if (r < 0)
4783 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4784
4785 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_inner_socket_pair) < 0)
4786 return log_error_errno(errno, "Failed to create inner socket pair: %m");
4787
4788 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_outer_socket_pair) < 0)
4789 return log_error_errno(errno, "Failed to create outer socket pair: %m");
4790
4791 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4792 * parent's blocking calls and give it a chance to call wait() and terminate. */
4793 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4794 if (r < 0)
4795 return log_error_errno(errno, "Failed to change the signal mask: %m");
4796
4797 r = sigaction(SIGCHLD, &sa, NULL);
4798 if (r < 0)
4799 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4800
4801 if (arg_network_namespace_path) {
4802 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4803 if (child_netns_fd < 0)
4804 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4805
4806 r = fd_is_ns(child_netns_fd, CLONE_NEWNET);
4807 if (r == -EUCLEAN)
4808 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4809 else if (r < 0)
4810 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
4811 else if (r == 0)
4812 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4813 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
4814 }
4815
4816 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4817 if (*pid < 0)
4818 return log_error_errno(errno, "clone() failed%s: %m",
4819 errno == EINVAL ?
4820 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4821
4822 if (*pid == 0) {
4823 /* The outer child only has a file system namespace. */
4824 barrier_set_role(&barrier, BARRIER_CHILD);
4825
4826 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
4827 fd_outer_socket_pair[0] = safe_close(fd_outer_socket_pair[0]);
4828
4829 (void) reset_all_signal_handlers();
4830 (void) reset_signal_mask();
4831
4832 r = outer_child(&barrier,
4833 arg_directory,
4834 dissected_image,
4835 secondary,
4836 fd_outer_socket_pair[1],
4837 fd_inner_socket_pair[1],
4838 fds,
4839 child_netns_fd);
4840 if (r < 0)
4841 _exit(EXIT_FAILURE);
4842
4843 _exit(EXIT_SUCCESS);
4844 }
4845
4846 barrier_set_role(&barrier, BARRIER_PARENT);
4847
4848 fdset_close(fds);
4849
4850 fd_inner_socket_pair[1] = safe_close(fd_inner_socket_pair[1]);
4851 fd_outer_socket_pair[1] = safe_close(fd_outer_socket_pair[1]);
4852
4853 if (arg_userns_mode != USER_NAMESPACE_NO) {
4854 mntns_fd = receive_one_fd(fd_outer_socket_pair[0], 0);
4855 if (mntns_fd < 0)
4856 return log_error_errno(mntns_fd, "Failed to receive mount namespace fd from outer child: %m");
4857
4858 /* The child just let us know the UID shift it might have read from the image. */
4859 l = recv(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
4860 if (l < 0)
4861 return log_error_errno(errno, "Failed to read UID shift: %m");
4862 if (l != sizeof arg_uid_shift)
4863 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
4864
4865 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4866 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4867 * image, but if that's already in use, pick a new one, and report back to the child,
4868 * which one we now picked. */
4869
4870 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4871 if (r < 0)
4872 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4873
4874 l = send(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
4875 if (l < 0)
4876 return log_error_errno(errno, "Failed to send UID shift: %m");
4877 if (l != sizeof arg_uid_shift)
4878 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
4879 }
4880
4881 n_bind_user_uid = strv_length(arg_bind_user);
4882 if (n_bind_user_uid > 0) {
4883 /* Right after the UID shift, we'll receive the list of UID mappings for the
4884 * --bind-user= logic. Always a quadruplet of payload and host UID + GID. */
4885
4886 bind_user_uid = new(uid_t, n_bind_user_uid*4);
4887 if (!bind_user_uid)
4888 return log_oom();
4889
4890 for (size_t i = 0; i < n_bind_user_uid; i++) {
4891 l = recv(fd_outer_socket_pair[0], bind_user_uid + i*4, sizeof(uid_t)*4, 0);
4892 if (l < 0)
4893 return log_error_errno(errno, "Failed to read user UID map pair: %m");
4894 if (l != sizeof(uid_t)*4)
4895 return log_full_errno(l == 0 ? LOG_DEBUG : LOG_WARNING,
4896 SYNTHETIC_ERRNO(EIO),
4897 "Short read while reading bind user UID pairs.");
4898 }
4899 }
4900 }
4901
4902 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4903 /* The child let us know the support cgroup mode it might have read from the image. */
4904 l = recv(fd_outer_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
4905 if (l < 0)
4906 return log_error_errno(errno, "Failed to read cgroup mode: %m");
4907 if (l != sizeof(arg_unified_cgroup_hierarchy))
4908 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
4909 l, l == 0 ? " The child is most likely dead." : "");
4910 }
4911
4912 /* Wait for the outer child. */
4913 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4914 if (r < 0)
4915 return r;
4916 if (r != EXIT_SUCCESS)
4917 return -EIO;
4918
4919 /* And now retrieve the PID of the inner child. */
4920 l = recv(fd_outer_socket_pair[0], pid, sizeof *pid, 0);
4921 if (l < 0)
4922 return log_error_errno(errno, "Failed to read inner child PID: %m");
4923 if (l != sizeof *pid)
4924 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
4925
4926 /* We also retrieve container UUID in case it was generated by outer child */
4927 l = recv(fd_outer_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
4928 if (l < 0)
4929 return log_error_errno(errno, "Failed to read container machine ID: %m");
4930 if (l != sizeof(arg_uuid))
4931 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
4932
4933 /* We also retrieve the socket used for notifications generated by outer child */
4934 notify_socket = receive_one_fd(fd_outer_socket_pair[0], 0);
4935 if (notify_socket < 0)
4936 return log_error_errno(notify_socket,
4937 "Failed to receive notification socket from the outer child: %m");
4938
4939 log_debug("Init process invoked as PID "PID_FMT, *pid);
4940
4941 if (arg_userns_mode != USER_NAMESPACE_NO) {
4942 if (!barrier_place_and_sync(&barrier)) /* #1 */
4943 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
4944
4945 r = setup_uid_map(*pid, bind_user_uid, n_bind_user_uid);
4946 if (r < 0)
4947 return r;
4948
4949 (void) barrier_place(&barrier); /* #2 */
4950 }
4951
4952 if (arg_private_network) {
4953 if (!arg_network_namespace_path) {
4954 /* Wait until the child has unshared its network namespace. */
4955 if (!barrier_place_and_sync(&barrier)) /* #3 */
4956 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
4957 }
4958
4959 if (child_netns_fd < 0) {
4960 /* Make sure we have an open file descriptor to the child's network
4961 * namespace so it stays alive even if the child exits. */
4962 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
4963 if (r < 0)
4964 return log_error_errno(r, "Failed to open child network namespace: %m");
4965 }
4966
4967 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
4968 if (r < 0)
4969 return r;
4970
4971 if (arg_network_veth) {
4972 r = setup_veth(arg_machine, *pid, veth_name,
4973 arg_network_bridge || arg_network_zone);
4974 if (r < 0)
4975 return r;
4976 else if (r > 0)
4977 ifi = r;
4978
4979 if (arg_network_bridge) {
4980 /* Add the interface to a bridge */
4981 r = setup_bridge(veth_name, arg_network_bridge, false);
4982 if (r < 0)
4983 return r;
4984 if (r > 0)
4985 ifi = r;
4986 } else if (arg_network_zone) {
4987 /* Add the interface to a bridge, possibly creating it */
4988 r = setup_bridge(veth_name, arg_network_zone, true);
4989 if (r < 0)
4990 return r;
4991 if (r > 0)
4992 ifi = r;
4993 }
4994 }
4995
4996 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
4997 if (r < 0)
4998 return r;
4999
5000 /* We created the primary and extra veth links now; let's remember this, so that we know to
5001 remove them later on. Note that we don't bother with removing veth links that were created
5002 here when their setup failed half-way, because in that case the kernel should be able to
5003 remove them on its own, since they cannot be referenced by anything yet. */
5004 *veth_created = true;
5005
5006 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
5007 if (r < 0)
5008 return r;
5009
5010 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
5011 if (r < 0)
5012 return r;
5013 }
5014
5015 if (arg_register || !arg_keep_unit) {
5016 r = sd_bus_default_system(&bus);
5017 if (r < 0)
5018 return log_error_errno(r, "Failed to open system bus: %m");
5019
5020 r = sd_bus_set_close_on_exit(bus, false);
5021 if (r < 0)
5022 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
5023 }
5024
5025 if (!arg_keep_unit) {
5026 /* When a new scope is created for this container, then we'll be registered as its controller, in which
5027 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
5028 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
5029
5030 r = sd_bus_match_signal_async(
5031 bus,
5032 NULL,
5033 "org.freedesktop.systemd1",
5034 NULL,
5035 "org.freedesktop.systemd1.Scope",
5036 "RequestStop",
5037 on_request_stop, NULL, PID_TO_PTR(*pid));
5038 if (r < 0)
5039 return log_error_errno(r, "Failed to request RequestStop match: %m");
5040 }
5041
5042 if (arg_register) {
5043 r = register_machine(
5044 bus,
5045 arg_machine,
5046 *pid,
5047 arg_directory,
5048 arg_uuid,
5049 ifi,
5050 arg_slice,
5051 arg_custom_mounts, arg_n_custom_mounts,
5052 arg_kill_signal,
5053 arg_property,
5054 arg_property_message,
5055 arg_keep_unit,
5056 arg_container_service_name);
5057 if (r < 0)
5058 return r;
5059
5060 } else if (!arg_keep_unit) {
5061 r = allocate_scope(
5062 bus,
5063 arg_machine,
5064 *pid,
5065 arg_slice,
5066 arg_custom_mounts, arg_n_custom_mounts,
5067 arg_kill_signal,
5068 arg_property,
5069 arg_property_message);
5070 if (r < 0)
5071 return r;
5072
5073 } else if (arg_slice || arg_property)
5074 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
5075
5076 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
5077 if (r < 0)
5078 return r;
5079
5080 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
5081 if (r < 0)
5082 return r;
5083
5084 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
5085 if (r < 0)
5086 return r;
5087
5088 /* Notify the child that the parent is ready with all
5089 * its setup (including cgroup-ification), and that
5090 * the child can now hand over control to the code to
5091 * run inside the container. */
5092 (void) barrier_place(&barrier); /* #4 */
5093
5094 /* Block SIGCHLD here, before notifying child.
5095 * process_pty() will handle it with the other signals. */
5096 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
5097
5098 /* Reset signal to default */
5099 r = default_signals(SIGCHLD);
5100 if (r < 0)
5101 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
5102
5103 r = sd_event_new(&event);
5104 if (r < 0)
5105 return log_error_errno(r, "Failed to get default event source: %m");
5106
5107 (void) sd_event_set_watchdog(event, true);
5108
5109 if (bus) {
5110 r = sd_bus_attach_event(bus, event, 0);
5111 if (r < 0)
5112 return log_error_errno(r, "Failed to attach bus to event loop: %m");
5113 }
5114
5115 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
5116 if (r < 0)
5117 return r;
5118
5119 if (arg_userns_mode != USER_NAMESPACE_NO) {
5120 r = wipe_fully_visible_fs(mntns_fd);
5121 if (r < 0)
5122 return r;
5123 mntns_fd = safe_close(mntns_fd);
5124 }
5125
5126 /* Let the child know that we are ready and wait that the child is completely ready now. */
5127 if (!barrier_place_and_sync(&barrier)) /* #5 */
5128 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
5129
5130 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
5131 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
5132 etc_passwd_lock = safe_close(etc_passwd_lock);
5133
5134 (void) sd_notifyf(false,
5135 "STATUS=Container running.\n"
5136 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
5137 if (!arg_notify_ready) {
5138 r = sd_notify(false, "READY=1\n");
5139 if (r < 0)
5140 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
5141 }
5142
5143 if (arg_kill_signal > 0) {
5144 /* Try to kill the init system on SIGINT or SIGTERM */
5145 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
5146 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
5147 } else {
5148 /* Immediately exit */
5149 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
5150 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
5151 }
5152
5153 /* Exit when the child exits */
5154 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
5155
5156 /* Retrieve the kmsg fifo allocated by inner child */
5157 fd_kmsg_fifo = receive_one_fd(fd_inner_socket_pair[0], 0);
5158 if (fd_kmsg_fifo < 0)
5159 return log_error_errno(fd_kmsg_fifo, "Failed to receive kmsg fifo from inner child: %m");
5160
5161 if (arg_expose_ports) {
5162 r = expose_port_watch_rtnl(event, fd_inner_socket_pair[0], on_address_change, expose_args, &rtnl);
5163 if (r < 0)
5164 return r;
5165
5166 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5167 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
5168 }
5169
5170 if (arg_console_mode != CONSOLE_PIPE) {
5171 _cleanup_close_ int fd = -1;
5172 PTYForwardFlags flags = 0;
5173
5174 /* Retrieve the master pty allocated by inner child */
5175 fd = receive_one_fd(fd_inner_socket_pair[0], 0);
5176 if (fd < 0)
5177 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
5178
5179 switch (arg_console_mode) {
5180
5181 case CONSOLE_READ_ONLY:
5182 flags |= PTY_FORWARD_READ_ONLY;
5183
5184 _fallthrough_;
5185
5186 case CONSOLE_INTERACTIVE:
5187 flags |= PTY_FORWARD_IGNORE_VHANGUP;
5188
5189 r = pty_forward_new(event, fd, flags, &forward);
5190 if (r < 0)
5191 return log_error_errno(r, "Failed to create PTY forwarder: %m");
5192
5193 if (arg_console_width != UINT_MAX || arg_console_height != UINT_MAX)
5194 (void) pty_forward_set_width_height(forward,
5195 arg_console_width,
5196 arg_console_height);
5197 break;
5198
5199 default:
5200 assert(arg_console_mode == CONSOLE_PASSIVE);
5201 }
5202
5203 *master = TAKE_FD(fd);
5204 }
5205
5206 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
5207
5208 r = sd_event_loop(event);
5209 if (r < 0)
5210 return log_error_errno(r, "Failed to run event loop: %m");
5211
5212 if (forward) {
5213 char last_char = 0;
5214
5215 (void) pty_forward_get_last_char(forward, &last_char);
5216 forward = pty_forward_free(forward);
5217
5218 if (!arg_quiet && last_char != '\n')
5219 putc('\n', stdout);
5220 }
5221
5222 /* Kill if it is not dead yet anyway */
5223 if (!arg_register && !arg_keep_unit && bus)
5224 terminate_scope(bus, arg_machine);
5225
5226 /* Normally redundant, but better safe than sorry */
5227 (void) kill(*pid, SIGKILL);
5228
5229 fd_kmsg_fifo = safe_close(fd_kmsg_fifo);
5230
5231 if (arg_private_network) {
5232 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
5233 * to avoid having to move the parent to the child network namespace. */
5234 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
5235 if (r < 0)
5236 return r;
5237
5238 if (r == 0) {
5239 _cleanup_close_ int parent_netns_fd = -1;
5240
5241 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
5242 if (r < 0) {
5243 log_error_errno(r, "Failed to open parent network namespace: %m");
5244 _exit(EXIT_FAILURE);
5245 }
5246
5247 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
5248 if (r < 0) {
5249 log_error_errno(r, "Failed to enter child network namespace: %m");
5250 _exit(EXIT_FAILURE);
5251 }
5252
5253 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
5254 if (r < 0)
5255 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
5256
5257 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
5258 }
5259 }
5260
5261 r = wait_for_container(TAKE_PID(*pid), &container_status);
5262
5263 /* Tell machined that we are gone. */
5264 if (bus)
5265 (void) unregister_machine(bus, arg_machine);
5266
5267 if (r < 0)
5268 /* We failed to wait for the container, or the container exited abnormally. */
5269 return r;
5270 if (r > 0 || container_status == CONTAINER_TERMINATED) {
5271 /* r > 0 → The container exited with a non-zero status.
5272 * As a special case, we need to replace 133 with a different value,
5273 * because 133 is special-cased in the service file to reboot the container.
5274 * otherwise → The container exited with zero status and a reboot was not requested.
5275 */
5276 if (r == EXIT_FORCE_RESTART)
5277 r = EXIT_FAILURE; /* replace 133 with the general failure code */
5278 *ret = r;
5279 return 0; /* finito */
5280 }
5281
5282 /* CONTAINER_REBOOTED, loop again */
5283
5284 if (arg_keep_unit) {
5285 /* Special handling if we are running as a service: instead of simply
5286 * restarting the machine we want to restart the entire service, so let's
5287 * inform systemd about this with the special exit code 133. The service
5288 * file uses RestartForceExitStatus=133 so that this results in a full
5289 * nspawn restart. This is necessary since we might have cgroup parameters
5290 * set we want to have flushed out. */
5291 *ret = EXIT_FORCE_RESTART;
5292 return 0; /* finito */
5293 }
5294
5295 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5296 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
5297
5298 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5299 *veth_created = false;
5300 return 1; /* loop again */
5301}
5302
5303static int initialize_rlimits(void) {
5304 /* The default resource limits the kernel passes to PID 1, as per kernel 5.16. Let's pass our container payload
5305 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
5306 * container execution environments. */
5307
5308 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
5309 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
5310 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
5311 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
5312 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
5313 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
5314 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
5315 [RLIMIT_MEMLOCK] = { DEFAULT_RLIMIT_MEMLOCK, DEFAULT_RLIMIT_MEMLOCK },
5316 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
5317 [RLIMIT_NICE] = { 0, 0 },
5318 [RLIMIT_NOFILE] = { 1024, 4096 },
5319 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
5320 [RLIMIT_RTPRIO] = { 0, 0 },
5321 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
5322 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
5323
5324 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
5325 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
5326 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
5327 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
5328 * that PID 1 changes a number of other resource limits during early initialization which is why we
5329 * don't read the other limits from PID 1 but prefer the static table above. */
5330 };
5331
5332 int rl;
5333
5334 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
5335 /* Let's only fill in what the user hasn't explicitly configured anyway */
5336 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
5337 const struct rlimit *v;
5338 struct rlimit buffer;
5339
5340 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
5341 /* For these two let's read the limits off PID 1. See above for an explanation. */
5342
5343 if (prlimit(1, rl, NULL, &buffer) < 0)
5344 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
5345
5346 v = &buffer;
5347 } else if (rl == RLIMIT_NOFILE) {
5348 /* We nowadays bump RLIMIT_NOFILE's hard limit early in PID 1 for all
5349 * userspace. Given that nspawn containers are often run without our PID 1,
5350 * let's grant the containers a raised RLIMIT_NOFILE hard limit by default,
5351 * so that container userspace gets similar resources as host userspace
5352 * gets. */
5353 buffer = kernel_defaults[rl];
5354 buffer.rlim_max = MIN((rlim_t) read_nr_open(), (rlim_t) HIGH_RLIMIT_NOFILE);
5355 v = &buffer;
5356 } else
5357 v = kernel_defaults + rl;
5358
5359 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
5360 if (!arg_rlimit[rl])
5361 return log_oom();
5362 }
5363
5364 if (DEBUG_LOGGING) {
5365 _cleanup_free_ char *k = NULL;
5366
5367 (void) rlimit_format(arg_rlimit[rl], &k);
5368 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
5369 }
5370 }
5371
5372 return 0;
5373}
5374
5375static int cant_be_in_netns(void) {
5376 _cleanup_close_ int fd = -1;
5377 struct ucred ucred;
5378 int r;
5379
5380 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
5381 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
5382 * nice message. */
5383
5384 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
5385 return 0;
5386
5387 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
5388 if (fd < 0)
5389 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
5390
5391 r = connect_unix_path(fd, AT_FDCWD, "/run/udev/control");
5392 if (r < 0) {
5393 if (r == -ENOENT || ERRNO_IS_DISCONNECT(r))
5394 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5395 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
5396
5397 return log_error_errno(r, "Failed to connect socket to udev control socket: %m");
5398 }
5399
5400 r = getpeercred(fd, &ucred);
5401 if (r < 0)
5402 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
5403
5404 r = in_same_namespace(ucred.pid, 0, NAMESPACE_NET);
5405 if (r < 0)
5406 return log_error_errno(r, "Failed to determine network namespace of udev: %m");
5407 if (r == 0)
5408 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5409 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
5410 return 0;
5411}
5412
5413static int run(int argc, char *argv[]) {
5414 bool secondary = false, remove_directory = false, remove_image = false,
5415 veth_created = false, remove_tmprootdir = false;
5416 _cleanup_close_ int master = -1;
5417 _cleanup_fdset_free_ FDSet *fds = NULL;
5418 int r, n_fd_passed, ret = EXIT_SUCCESS;
5419 char veth_name[IFNAMSIZ] = "";
5420 struct ExposeArgs expose_args = {};
5421 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
5422 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
5423 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
5424 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
5425 _cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
5426 pid_t pid = 0;
5427
5428 log_parse_environment();
5429 log_open();
5430
5431 r = parse_argv(argc, argv);
5432 if (r <= 0)
5433 goto finish;
5434
5435 if (geteuid() != 0) {
5436 r = log_warning_errno(SYNTHETIC_ERRNO(EPERM),
5437 argc >= 2 ? "Need to be root." :
5438 "Need to be root (and some arguments are usually required).\nHint: try --help");
5439 goto finish;
5440 }
5441
5442 r = cant_be_in_netns();
5443 if (r < 0)
5444 goto finish;
5445
5446 r = initialize_rlimits();
5447 if (r < 0)
5448 goto finish;
5449
5450 r = load_oci_bundle();
5451 if (r < 0)
5452 goto finish;
5453
5454 r = determine_names();
5455 if (r < 0)
5456 goto finish;
5457
5458 r = load_settings();
5459 if (r < 0)
5460 goto finish;
5461
5462 r = cg_unified();
5463 if (r < 0) {
5464 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
5465 goto finish;
5466 }
5467
5468 r = verify_arguments();
5469 if (r < 0)
5470 goto finish;
5471
5472 /* Reapply environment settings. */
5473 (void) detect_unified_cgroup_hierarchy_from_environment();
5474
5475 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
5476 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
5477 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
5478 (void) ignore_signals(SIGPIPE);
5479
5480 n_fd_passed = sd_listen_fds(false);
5481 if (n_fd_passed > 0) {
5482 r = fdset_new_listen_fds(&fds, false);
5483 if (r < 0) {
5484 log_error_errno(r, "Failed to collect file descriptors: %m");
5485 goto finish;
5486 }
5487 }
5488
5489 /* The "default" umask. This is appropriate for most file and directory
5490 * operations performed by nspawn, and is the umask that will be used for
5491 * the child. Functions like copy_devnodes() change the umask temporarily. */
5492 umask(0022);
5493
5494 if (arg_directory) {
5495 assert(!arg_image);
5496
5497 /* Safety precaution: let's not allow running images from the live host OS image, as long as
5498 * /var from the host will propagate into container dynamically (because bad things happen if
5499 * two systems write to the same /var). Let's allow it for the special cases where /var is
5500 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
5501 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
5502 log_error("Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
5503 r = -EINVAL;
5504 goto finish;
5505 }
5506
5507 if (arg_ephemeral) {
5508 _cleanup_free_ char *np = NULL;
5509
5510 r = chase_symlinks_and_update(&arg_directory, 0);
5511 if (r < 0)
5512 goto finish;
5513
5514 /* If the specified path is a mount point we generate the new snapshot immediately
5515 * inside it under a random name. However if the specified is not a mount point we
5516 * create the new snapshot in the parent directory, just next to it. */
5517 r = path_is_mount_point(arg_directory, NULL, 0);
5518 if (r < 0) {
5519 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5520 goto finish;
5521 }
5522 if (r > 0)
5523 r = tempfn_random_child(arg_directory, "machine.", &np);
5524 else
5525 r = tempfn_random(arg_directory, "machine.", &np);
5526 if (r < 0) {
5527 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
5528 goto finish;
5529 }
5530
5531 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
5532 * only owned by us and no one else. */
5533 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
5534 if (r < 0) {
5535 log_error_errno(r, "Failed to lock %s: %m", np);
5536 goto finish;
5537 }
5538
5539 {
5540 BLOCK_SIGNALS(SIGINT);
5541 r = btrfs_subvol_snapshot(arg_directory, np,
5542 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5543 BTRFS_SNAPSHOT_FALLBACK_COPY |
5544 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5545 BTRFS_SNAPSHOT_RECURSIVE |
5546 BTRFS_SNAPSHOT_QUOTA |
5547 BTRFS_SNAPSHOT_SIGINT);
5548 }
5549 if (r == -EINTR) {
5550 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5551 goto finish;
5552 }
5553 if (r < 0) {
5554 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5555 goto finish;
5556 }
5557
5558 free_and_replace(arg_directory, np);
5559 remove_directory = true;
5560 } else {
5561 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
5562 if (r < 0)
5563 goto finish;
5564
5565 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5566 if (r == -EBUSY) {
5567 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5568 goto finish;
5569 }
5570 if (r < 0) {
5571 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
5572 goto finish;
5573 }
5574
5575 if (arg_template) {
5576 r = chase_symlinks_and_update(&arg_template, 0);
5577 if (r < 0)
5578 goto finish;
5579
5580 {
5581 BLOCK_SIGNALS(SIGINT);
5582 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5583 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5584 BTRFS_SNAPSHOT_FALLBACK_COPY |
5585 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5586 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5587 BTRFS_SNAPSHOT_RECURSIVE |
5588 BTRFS_SNAPSHOT_QUOTA |
5589 BTRFS_SNAPSHOT_SIGINT);
5590 }
5591 if (r == -EEXIST)
5592 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5593 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
5594 else if (r == -EINTR) {
5595 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5596 goto finish;
5597 } else if (r < 0) {
5598 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
5599 goto finish;
5600 } else
5601 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5602 "Populated %s from template %s.", arg_directory, arg_template);
5603 }
5604 }
5605
5606 if (arg_start_mode == START_BOOT) {
5607 _cleanup_free_ char *b = NULL;
5608 const char *p;
5609
5610 if (arg_pivot_root_new) {
5611 b = path_join(arg_directory, arg_pivot_root_new);
5612 if (!b)
5613 return log_oom();
5614
5615 p = b;
5616 } else
5617 p = arg_directory;
5618
5619 if (path_is_os_tree(p) <= 0) {
5620 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5621 "Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
5622 goto finish;
5623 }
5624 } else {
5625 _cleanup_free_ char *p = NULL;
5626
5627 if (arg_pivot_root_new)
5628 p = path_join(arg_directory, arg_pivot_root_new, "/usr/");
5629 else
5630 p = path_join(arg_directory, "/usr/");
5631 if (!p)
5632 return log_oom();
5633
5634 if (laccess(p, F_OK) < 0) {
5635 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5636 "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
5637 goto finish;
5638 }
5639 }
5640
5641 } else {
5642 DissectImageFlags dissect_image_flags =
5643 DISSECT_IMAGE_GENERIC_ROOT |
5644 DISSECT_IMAGE_REQUIRE_ROOT |
5645 DISSECT_IMAGE_RELAX_VAR_CHECK |
5646 DISSECT_IMAGE_USR_NO_ROOT |
5647 DISSECT_IMAGE_ADD_PARTITION_DEVICES |
5648 DISSECT_IMAGE_PIN_PARTITION_DEVICES;
5649 assert(arg_image);
5650 assert(!arg_template);
5651
5652 r = chase_symlinks_and_update(&arg_image, 0);
5653 if (r < 0)
5654 goto finish;
5655
5656 if (arg_ephemeral) {
5657 _cleanup_free_ char *np = NULL;
5658
5659 r = tempfn_random(arg_image, "machine.", &np);
5660 if (r < 0) {
5661 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5662 goto finish;
5663 }
5664
5665 /* Always take an exclusive lock on our own ephemeral copy. */
5666 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
5667 if (r < 0) {
5668 r = log_error_errno(r, "Failed to create image lock: %m");
5669 goto finish;
5670 }
5671
5672 {
5673 BLOCK_SIGNALS(SIGINT);
5674 r = copy_file(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600, FS_NOCOW_FL, FS_NOCOW_FL, COPY_REFLINK|COPY_CRTIME|COPY_SIGINT);
5675 }
5676 if (r == -EINTR) {
5677 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5678 goto finish;
5679 }
5680 if (r < 0) {
5681 r = log_error_errno(r, "Failed to copy image file: %m");
5682 goto finish;
5683 }
5684
5685 free_and_replace(arg_image, np);
5686 remove_image = true;
5687 } else {
5688 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5689 if (r == -EBUSY) {
5690 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5691 goto finish;
5692 }
5693 if (r < 0) {
5694 r = log_error_errno(r, "Failed to create image lock: %m");
5695 goto finish;
5696 }
5697
5698 r = verity_settings_load(
5699 &arg_verity_settings,
5700 arg_image, NULL, NULL);
5701 if (r < 0) {
5702 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5703 goto finish;
5704 }
5705
5706 if (arg_verity_settings.data_path)
5707 dissect_image_flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
5708 }
5709
5710 if (!mkdtemp(tmprootdir)) {
5711 r = log_error_errno(errno, "Failed to create temporary directory: %m");
5712 goto finish;
5713 }
5714
5715 remove_tmprootdir = true;
5716
5717 arg_directory = strdup(tmprootdir);
5718 if (!arg_directory) {
5719 r = log_oom();
5720 goto finish;
5721 }
5722
5723 r = loop_device_make_by_path(
5724 arg_image,
5725 arg_read_only ? O_RDONLY : O_RDWR,
5726 FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
5727 LOCK_SH,
5728 &loop);
5729 if (r < 0) {
5730 log_error_errno(r, "Failed to set up loopback block device: %m");
5731 goto finish;
5732 }
5733
5734 r = dissect_loop_device_and_warn(
5735 loop,
5736 &arg_verity_settings,
5737 NULL,
5738 dissect_image_flags,
5739 &dissected_image);
5740 if (r == -ENOPKG) {
5741 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
5742 log_notice("Note that the disk image needs to\n"
5743 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5744 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
5745 " c) or follow https://uapi-group.org/specifications/specs/discoverable_partitions_specification\n"
5746 " d) or contain a file system without a partition table\n"
5747 "in order to be bootable with systemd-nspawn.");
5748 goto finish;
5749 }
5750 if (r < 0)
5751 goto finish;
5752
5753 r = dissected_image_load_verity_sig_partition(
5754 dissected_image,
5755 loop->fd,
5756 &arg_verity_settings);
5757 if (r < 0)
5758 goto finish;
5759
5760 if (dissected_image->has_verity && !arg_verity_settings.root_hash && !dissected_image->has_verity_sig)
5761 log_notice("Note: image %s contains verity information, but no root hash specified and no embedded "
5762 "root hash signature found! Proceeding without integrity checking.", arg_image);
5763
5764 r = dissected_image_decrypt_interactively(
5765 dissected_image,
5766 NULL,
5767 &arg_verity_settings,
5768 0);
5769 if (r < 0)
5770 goto finish;
5771
5772 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5773 if (remove_image && unlink(arg_image) >= 0)
5774 remove_image = false;
5775 }
5776
5777 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5778 if (r < 0)
5779 goto finish;
5780
5781 if (arg_console_mode < 0)
5782 arg_console_mode =
5783 isatty(STDIN_FILENO) > 0 &&
5784 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
5785
5786 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5787 arg_quiet = true;
5788
5789 if (!arg_quiet)
5790 log_info("Spawning container %s on %s.\nPress Ctrl-] three times within 1s to kill container.",
5791 arg_machine, arg_image ?: arg_directory);
5792
5793 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
5794
5795 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
5796 r = log_error_errno(errno, "Failed to become subreaper: %m");
5797 goto finish;
5798 }
5799
5800 if (arg_expose_ports) {
5801 r = fw_ctx_new(&fw_ctx);
5802 if (r < 0) {
5803 log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
5804 goto finish;
5805 }
5806 expose_args.fw_ctx = fw_ctx;
5807 }
5808 for (;;) {
5809 r = run_container(dissected_image,
5810 secondary,
5811 fds,
5812 veth_name, &veth_created,
5813 &expose_args, &master,
5814 &pid, &ret);
5815 if (r <= 0)
5816 break;
5817 }
5818
5819finish:
5820 (void) sd_notify(false,
5821 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5822 "STOPPING=1\nSTATUS=Terminating...");
5823
5824 if (pid > 0)
5825 (void) kill(pid, SIGKILL);
5826
5827 /* Try to flush whatever is still queued in the pty */
5828 if (master >= 0) {
5829 (void) copy_bytes(master, STDOUT_FILENO, UINT64_MAX, 0);
5830 master = safe_close(master);
5831 }
5832
5833 if (pid > 0)
5834 (void) wait_for_terminate(pid, NULL);
5835
5836 pager_close();
5837
5838 if (remove_directory && arg_directory) {
5839 int k;
5840
5841 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
5842 if (k < 0)
5843 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
5844 }
5845
5846 if (remove_image && arg_image) {
5847 if (unlink(arg_image) < 0)
5848 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5849 }
5850
5851 if (remove_tmprootdir) {
5852 if (rmdir(tmprootdir) < 0)
5853 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5854 }
5855
5856 if (arg_machine) {
5857 const char *p;
5858
5859 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
5860 (void) rm_rf(p, REMOVE_ROOT);
5861 }
5862
5863 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET, &expose_args.address4);
5864 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET6, &expose_args.address6);
5865
5866 if (veth_created)
5867 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5868 (void) remove_bridge(arg_network_zone);
5869
5870 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5871 expose_port_free_all(arg_expose_ports);
5872 rlimit_free_all(arg_rlimit);
5873 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
5874 credential_free_all(arg_credentials, arg_n_credentials);
5875
5876 if (r < 0)
5877 return r;
5878
5879 return ret;
5880}
5881
5882DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.