src/core/machine-id-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <errno.h>
  23 #include <fcntl.h>
  24 #include <sched.h>
  25 #include <stdio.h>
  26 #include <string.h>
  27 #include <sys/mount.h>
  28 #include <unistd.h>
  29
  30 #include "sd-id128.h"
  31
  32 #include "alloc-util.h"
  33 #include "fd-util.h"
  34 #include "fileio.h"
  35 #include "fs-util.h"
  36 #include "hexdecoct.h"
  37 #include "io-util.h"
  38 #include "log.h"
  39 #include "machine-id-setup.h"
  40 #include "macro.h"
  41 #include "mkdir.h"
  42 #include "mount-util.h"
  43 #include "path-util.h"
  44 #include "process-util.h"
  45 #include "stat-util.h"
  46 #include "string-util.h"
  47 #include "umask-util.h"
  48 #include "util.h"
  49 #include "virt.h"
  50
  51 static int shorten_uuid(char destination[34], const char source[36]) {
  52         unsigned i, j;
  53
  54         assert(destination);
  55         assert(source);
  56
  57         /* Converts a UUID into a machine ID, by lowercasing it and
  58          * removing dashes. Validates everything. */
  59
  60         for (i = 0, j = 0; i < 36 && j < 32; i++) {
  61                 int t;
  62
  63                 t = unhexchar(source[i]);
  64                 if (t < 0)
  65                         continue;
  66
  67                 destination[j++] = hexchar(t);
  68         }
  69
  70         if (i != 36 || j != 32)
  71                 return -EINVAL;
  72
  73         destination[32] = '\n';
  74         destination[33] = 0;
  75         return 0;
  76 }
  77
  78 static int read_machine_id(int fd, char id[34]) {
  79         char id_to_validate[34];
  80         int r;
  81
  82         assert(fd >= 0);
  83         assert(id);
  84
  85         /* Reads a machine ID from a file, validates it, and returns
  86          * it. The returned ID ends in a newline. */
  87
  88         r = loop_read_exact(fd, id_to_validate, 33, false);
  89         if (r < 0)
  90                 return r;
  91
  92         if (id_to_validate[32] != '\n')
  93                 return -EINVAL;
  94
  95         id_to_validate[32] = 0;
  96
  97         if (!id128_is_valid(id_to_validate))
  98                 return -EINVAL;
  99
 100         memcpy(id, id_to_validate, 32);
 101         id[32] = '\n';
 102         id[33] = 0;
 103         return 0;
 104 }
 105
 106 static int write_machine_id(int fd, char id[34]) {
 107         assert(fd >= 0);
 108         assert(id);
 109
 110         if (lseek(fd, 0, SEEK_SET) < 0)
 111                 return -errno;
 112
 113         return loop_write(fd, id, 33, false);
 114 }
 115
 116 static int generate_machine_id(char id[34], const char *root) {
 117         int fd, r;
 118         unsigned char *p;
 119         sd_id128_t buf;
 120         char  *q;
 121         const char *dbus_machine_id;
 122
 123         assert(id);
 124
 125         if (isempty(root))
 126                 dbus_machine_id = "/var/lib/dbus/machine-id";
 127         else
 128                 dbus_machine_id = strjoina(root, "/var/lib/dbus/machine-id");
 129
 130         /* First, try reading the D-Bus machine id, unless it is a symlink */
 131         fd = open(dbus_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
 132         if (fd >= 0) {
 133                 r = read_machine_id(fd, id);
 134                 safe_close(fd);
 135
 136                 if (r >= 0) {
 137                         log_info("Initializing machine ID from D-Bus machine ID.");
 138                         return 0;
 139                 }
 140         }
 141
 142         if (isempty(root)) {
 143                 /* If that didn't work, see if we are running in a container,
 144                  * and a machine ID was passed in via $container_uuid the way
 145                  * libvirt/LXC does it */
 146
 147                 if (detect_container() > 0) {
 148                         _cleanup_free_ char *e = NULL;
 149
 150                         r = getenv_for_pid(1, "container_uuid", &e);
 151                         if (r > 0) {
 152                                 r = shorten_uuid(id, e);
 153                                 if (r >= 0) {
 154                                         log_info("Initializing machine ID from container UUID.");
 155                                         return 0;
 156                                 }
 157                         }
 158
 159                 } else if (detect_vm() == VIRTUALIZATION_KVM) {
 160
 161                         /* If we are not running in a container, see if we are
 162                          * running in qemu/kvm and a machine ID was passed in
 163                          * via -uuid on the qemu/kvm command line */
 164
 165                         char uuid[36];
 166
 167                         fd = open("/sys/class/dmi/id/product_uuid", O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
 168                         if (fd >= 0) {
 169                                 r = loop_read_exact(fd, uuid, 36, false);
 170                                 safe_close(fd);
 171
 172                                 if (r >= 0) {
 173                                         r = shorten_uuid(id, uuid);
 174                                         if (r >= 0) {
 175                                                 log_info("Initializing machine ID from KVM UUID.");
 176                                                 return 0;
 177                                         }
 178                                 }
 179                         }
 180                 }
 181         }
 182
 183         /* If that didn't work, generate a random machine id */
 184         r = sd_id128_randomize(&buf);
 185         if (r < 0)
 186                 return log_error_errno(r, "Failed to open /dev/urandom: %m");
 187
 188         for (p = buf.bytes, q = id; p < buf.bytes + sizeof(buf); p++, q += 2) {
 189                 q[0] = hexchar(*p >> 4);
 190                 q[1] = hexchar(*p & 15);
 191         }
 192
 193         id[32] = '\n';
 194         id[33] = 0;
 195
 196         log_info("Initializing machine ID from random generator.");
 197
 198         return 0;
 199 }
 200
 201 int machine_id_setup(const char *root, sd_id128_t machine_id) {
 202         const char *etc_machine_id, *run_machine_id;
 203         _cleanup_close_ int fd = -1;
 204         bool writable = true;
 205         char id[34]; /* 32 + \n + \0 */
 206         int r;
 207
 208         if (isempty(root))  {
 209                 etc_machine_id = "/etc/machine-id";
 210                 run_machine_id = "/run/machine-id";
 211         } else {
 212                 char *x;
 213
 214                 x = strjoina(root, "/etc/machine-id");
 215                 etc_machine_id = path_kill_slashes(x);
 216
 217                 x = strjoina(root, "/run/machine-id");
 218                 run_machine_id = path_kill_slashes(x);
 219         }
 220
 221         RUN_WITH_UMASK(0000) {
 222                 /* We create this 0444, to indicate that this isn't really
 223                  * something you should ever modify. Of course, since the file
 224                  * will be owned by root it doesn't matter much, but maybe
 225                  * people look. */
 226
 227                 mkdir_parents(etc_machine_id, 0755);
 228                 fd = open(etc_machine_id, O_RDWR|O_CREAT|O_CLOEXEC|O_NOCTTY, 0444);
 229                 if (fd < 0) {
 230                         int old_errno = errno;
 231
 232                         fd = open(etc_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY);
 233                         if (fd < 0) {
 234                                 if (old_errno == EROFS && errno == ENOENT)
 235                                         log_error_errno(errno,
 236                                                   "System cannot boot: Missing /etc/machine-id and /etc is mounted read-only.\n"
 237                                                   "Booting up is supported only when:\n"
 238                                                   "1) /etc/machine-id exists and is populated.\n"
 239                                                   "2) /etc/machine-id exists and is empty.\n"
 240                                                   "3) /etc/machine-id is missing and /etc is writable.\n");
 241                                 else
 242                                         log_error_errno(errno, "Cannot open %s: %m", etc_machine_id);
 243
 244                                 return -errno;
 245                         }
 246
 247                         writable = false;
 248                 }
 249         }
 250
 251         /* A machine id argument overrides all other machined-ids */
 252         if (!sd_id128_is_null(machine_id)) {
 253                 sd_id128_to_string(machine_id, id);
 254                 id[32] = '\n';
 255                 id[33] = 0;
 256         } else {
 257                 if (read_machine_id(fd, id) >= 0)
 258                         return 0;
 259
 260                 /* Hmm, so, the id currently stored is not useful, then let's
 261                  * generate one */
 262
 263                 r = generate_machine_id(id, root);
 264                 if (r < 0)
 265                         return r;
 266         }
 267
 268         if (writable)
 269                 if (write_machine_id(fd, id) >= 0)
 270                         return 0;
 271
 272         fd = safe_close(fd);
 273
 274         /* Hmm, we couldn't write it? So let's write it to
 275          * /run/machine-id as a replacement */
 276
 277         RUN_WITH_UMASK(0022) {
 278                 r = write_string_file(run_machine_id, id, WRITE_STRING_FILE_CREATE);
 279         }
 280         if (r < 0) {
 281                 (void) unlink(run_machine_id);
 282                 return log_error_errno(r, "Cannot write %s: %m", run_machine_id);
 283         }
 284
 285         /* And now, let's mount it over */
 286         if (mount(run_machine_id, etc_machine_id, NULL, MS_BIND, NULL) < 0) {
 287                 (void) unlink_noerrno(run_machine_id);
 288                 return log_error_errno(errno, "Failed to mount %s: %m", etc_machine_id);
 289         }
 290
 291         log_info("Installed transient %s file.", etc_machine_id);
 292
 293         /* Mark the mount read-only */
 294         if (mount(NULL, etc_machine_id, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, NULL) < 0)
 295                 log_warning_errno(errno, "Failed to make transient %s read-only: %m", etc_machine_id);
 296
 297         return 0;
 298 }
 299
 300 int machine_id_commit(const char *root) {
 301         _cleanup_close_ int fd = -1, initial_mntns_fd = -1;
 302         const char *etc_machine_id;
 303         char id[34]; /* 32 + \n + \0 */
 304         int r;
 305
 306         if (isempty(root))
 307                 etc_machine_id = "/etc/machine-id";
 308         else {
 309                 char *x;
 310
 311                 x = strjoina(root, "/etc/machine-id");
 312                 etc_machine_id = path_kill_slashes(x);
 313         }
 314
 315         r = path_is_mount_point(etc_machine_id, 0);
 316         if (r < 0)
 317                 return log_error_errno(r, "Failed to determine whether %s is a mount point: %m", etc_machine_id);
 318         if (r == 0) {
 319                 log_debug("%s is is not a mount point. Nothing to do.", etc_machine_id);
 320                 return 0;
 321         }
 322
 323         /* Read existing machine-id */
 324         fd = open(etc_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY);
 325         if (fd < 0)
 326                 return log_error_errno(errno, "Cannot open %s: %m", etc_machine_id);
 327
 328         r = read_machine_id(fd, id);
 329         if (r < 0)
 330                 return log_error_errno(r, "We didn't find a valid machine ID in %s.", etc_machine_id);
 331
 332         r = fd_is_temporary_fs(fd);
 333         if (r < 0)
 334                 return log_error_errno(r, "Failed to determine whether %s is on a temporary file system: %m", etc_machine_id);
 335         if (r == 0) {
 336                 log_error("%s is not on a temporary file system.", etc_machine_id);
 337                 return -EROFS;
 338         }
 339
 340         fd = safe_close(fd);
 341
 342         /* Store current mount namespace */
 343         r = namespace_open(0, NULL, &initial_mntns_fd, NULL, NULL, NULL);
 344         if (r < 0)
 345                 return log_error_errno(r, "Can't fetch current mount namespace: %m");
 346
 347         /* Switch to a new mount namespace, isolate ourself and unmount etc_machine_id in our new namespace */
 348         if (unshare(CLONE_NEWNS) < 0)
 349                 return log_error_errno(errno, "Failed to enter new namespace: %m");
 350
 351         if (mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL) < 0)
 352                 return log_error_errno(errno, "Couldn't make-rslave / mountpoint in our private namespace: %m");
 353
 354         if (umount(etc_machine_id) < 0)
 355                 return log_error_errno(errno, "Failed to unmount transient %s file in our private namespace: %m", etc_machine_id);
 356
 357         /* Update a persistent version of etc_machine_id */
 358         fd = open(etc_machine_id, O_RDWR|O_CREAT|O_CLOEXEC|O_NOCTTY, 0444);
 359         if (fd < 0)
 360                 return log_error_errno(errno, "Cannot open for writing %s. This is mandatory to get a persistent machine-id: %m", etc_machine_id);
 361
 362         r = write_machine_id(fd, id);
 363         if (r < 0)
 364                 return log_error_errno(r, "Cannot write %s: %m", etc_machine_id);
 365
 366         fd = safe_close(fd);
 367
 368         /* Return to initial namespace and proceed a lazy tmpfs unmount */
 369         r = namespace_enter(-1, initial_mntns_fd, -1, -1, -1);
 370         if (r < 0)
 371                 return log_warning_errno(r, "Failed to switch back to initial mount namespace: %m.\nWe'll keep transient %s file until next reboot.", etc_machine_id);
 372
 373         if (umount2(etc_machine_id, MNT_DETACH) < 0)
 374                 return log_warning_errno(errno, "Failed to unmount transient %s file: %m.\nWe keep that mount until next reboot.", etc_machine_id);
 375
 376         return 0;
 377 }