src/core/mount-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2010 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <errno.h>
  22 #include <ftw.h>
  23 #include <stdlib.h>
  24 #include <sys/mount.h>
  25 #include <unistd.h>
  26
  27 #include "alloc-util.h"
  28 #include "bus-util.h"
  29 #include "cgroup-util.h"
  30 #include "dev-setup.h"
  31 #include "efivars.h"
  32 #include "fileio.h"
  33 #include "fs-util.h"
  34 #include "label.h"
  35 #include "log.h"
  36 #include "macro.h"
  37 #include "missing.h"
  38 #include "mkdir.h"
  39 #include "mount-setup.h"
  40 #include "mount-util.h"
  41 #include "path-util.h"
  42 #include "set.h"
  43 #include "smack-util.h"
  44 #include "strv.h"
  45 #include "user-util.h"
  46 #include "util.h"
  47 #include "virt.h"
  48
  49 typedef enum MountMode {
  50         MNT_NONE  =           0,
  51         MNT_FATAL =           1 <<  0,
  52         MNT_IN_CONTAINER =    1 <<  1,
  53         MNT_CHECK_WRITABLE  = 1 <<  2,
  54 } MountMode;
  55
  56 typedef struct MountPoint {
  57         const char *what;
  58         const char *where;
  59         const char *type;
  60         const char *options;
  61         unsigned long flags;
  62         bool (*condition_fn)(void);
  63         MountMode mode;
  64 } MountPoint;
  65
  66 /* The first three entries we might need before SELinux is up. The
  67  * fourth (securityfs) is needed by IMA to load a custom policy. The
  68  * other ones we can delay until SELinux and IMA are loaded. When
  69  * SMACK is enabled we need smackfs, too, so it's a fifth one. */
  70 #if ENABLE_SMACK
  71 #define N_EARLY_MOUNT 5
  72 #else
  73 #define N_EARLY_MOUNT 4
  74 #endif
  75
  76 static const MountPoint mount_table[] = {
  77         { "sysfs",       "/sys",                      "sysfs",      NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  78           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  79         { "proc",        "/proc",                     "proc",       NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  80           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  81         { "devtmpfs",    "/dev",                      "devtmpfs",   "mode=755",                MS_NOSUID|MS_STRICTATIME,
  82           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  83         { "securityfs",  "/sys/kernel/security",      "securityfs", NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  84           NULL,          MNT_NONE                   },
  85 #if ENABLE_SMACK
  86         { "smackfs",     "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*",            MS_NOSUID|MS_NOEXEC|MS_NODEV,
  87           mac_smack_use, MNT_FATAL                  },
  88         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  89           mac_smack_use, MNT_FATAL                  },
  90 #endif
  91         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777",               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  92           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  93         { "devpts",      "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
  94           NULL,          MNT_IN_CONTAINER           },
  95 #if ENABLE_SMACK
  96         { "tmpfs",       "/run",                      "tmpfs",      "mode=755,smackfsroot=*",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  97           mac_smack_use, MNT_FATAL                  },
  98 #endif
  99         { "tmpfs",       "/run",                      "tmpfs",      "mode=755",                MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 100           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
 101         { "cgroup",      "/sys/fs/cgroup",            "cgroup2",    "nsdelegate",              MS_NOSUID|MS_NOEXEC|MS_NODEV,
 102           cg_is_unified_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
 103         { "cgroup",      "/sys/fs/cgroup",            "cgroup2",    NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 104           cg_is_unified_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
 105         { "tmpfs",       "/sys/fs/cgroup",            "tmpfs",      "mode=755",                MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
 106           cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 107         { "cgroup",      "/sys/fs/cgroup/unified",    "cgroup2",    "nsdelegate",              MS_NOSUID|MS_NOEXEC|MS_NODEV,
 108           cg_is_hybrid_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
 109         { "cgroup",      "/sys/fs/cgroup/unified",    "cgroup2",    NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 110           cg_is_hybrid_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
 111         { "cgroup",      "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
 112           cg_is_legacy_wanted, MNT_IN_CONTAINER     },
 113         { "cgroup",      "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd",       MS_NOSUID|MS_NOEXEC|MS_NODEV,
 114           cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 115         { "pstore",      "/sys/fs/pstore",            "pstore",     NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 116           NULL,          MNT_NONE                   },
 117 #if ENABLE_EFI
 118         { "efivarfs",    "/sys/firmware/efi/efivars", "efivarfs",   NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 119           is_efi_boot,   MNT_NONE                   },
 120 #endif
 121 };
 122
 123 /* These are API file systems that might be mounted by other software,
 124  * we just list them here so that we know that we should ignore them */
 125
 126 static const char ignore_paths[] =
 127         /* SELinux file systems */
 128         "/sys/fs/selinux\0"
 129         /* Container bind mounts */
 130         "/proc/sys\0"
 131         "/dev/console\0"
 132         "/proc/kmsg\0";
 133
 134 bool mount_point_is_api(const char *path) {
 135         unsigned i;
 136
 137         /* Checks if this mount point is considered "API", and hence
 138          * should be ignored */
 139
 140         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
 141                 if (path_equal(path, mount_table[i].where))
 142                         return true;
 143
 144         return path_startswith(path, "/sys/fs/cgroup/");
 145 }
 146
 147 bool mount_point_ignore(const char *path) {
 148         const char *i;
 149
 150         NULSTR_FOREACH(i, ignore_paths)
 151                 if (path_equal(path, i))
 152                         return true;
 153
 154         return false;
 155 }
 156
 157 static int mount_one(const MountPoint *p, bool relabel) {
 158         int r;
 159
 160         assert(p);
 161
 162         if (p->condition_fn && !p->condition_fn())
 163                 return 0;
 164
 165         /* Relabel first, just in case */
 166         if (relabel)
 167                 (void) label_fix(p->where, true, true);
 168
 169         r = path_is_mount_point(p->where, NULL, AT_SYMLINK_FOLLOW);
 170         if (r < 0 && r != -ENOENT) {
 171                 log_full_errno((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, r, "Failed to determine whether %s is a mount point: %m", p->where);
 172                 return (p->mode & MNT_FATAL) ? r : 0;
 173         }
 174         if (r > 0)
 175                 return 0;
 176
 177         /* Skip securityfs in a container */
 178         if (!(p->mode & MNT_IN_CONTAINER) && detect_container() > 0)
 179                 return 0;
 180
 181         /* The access mode here doesn't really matter too much, since
 182          * the mounted file system will take precedence anyway. */
 183         if (relabel)
 184                 (void) mkdir_p_label(p->where, 0755);
 185         else
 186                 (void) mkdir_p(p->where, 0755);
 187
 188         log_debug("Mounting %s to %s of type %s with options %s.",
 189                   p->what,
 190                   p->where,
 191                   p->type,
 192                   strna(p->options));
 193
 194         if (mount(p->what,
 195                   p->where,
 196                   p->type,
 197                   p->flags,
 198                   p->options) < 0) {
 199                 log_full_errno((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, errno, "Failed to mount %s at %s: %m", p->type, p->where);
 200                 return (p->mode & MNT_FATAL) ? -errno : 0;
 201         }
 202
 203         /* Relabel again, since we now mounted something fresh here */
 204         if (relabel)
 205                 (void) label_fix(p->where, false, false);
 206
 207         if (p->mode & MNT_CHECK_WRITABLE) {
 208                 r = access(p->where, W_OK);
 209                 if (r < 0) {
 210                         (void) umount(p->where);
 211                         (void) rmdir(p->where);
 212                         return (p->mode & MNT_FATAL) ? r : 0;
 213                 }
 214         }
 215
 216         return 1;
 217 }
 218
 219 static int mount_points_setup(unsigned n, bool loaded_policy) {
 220         unsigned i;
 221         int r = 0;
 222
 223         for (i = 0; i < n; i ++) {
 224                 int j;
 225
 226                 j = mount_one(mount_table + i, loaded_policy);
 227                 if (j != 0 && r >= 0)
 228                         r = j;
 229         }
 230
 231         return r;
 232 }
 233
 234 int mount_setup_early(void) {
 235         assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));
 236
 237         /* Do a minimal mount of /proc and friends to enable the most
 238          * basic stuff, such as SELinux */
 239         return mount_points_setup(N_EARLY_MOUNT, false);
 240 }
 241
 242 int mount_cgroup_controllers(char ***join_controllers) {
 243         _cleanup_set_free_free_ Set *controllers = NULL;
 244         int r;
 245
 246         if (!cg_is_legacy_wanted())
 247                 return 0;
 248
 249         /* Mount all available cgroup controllers that are built into the kernel. */
 250
 251         r = cg_kernel_controllers(&controllers);
 252         if (r < 0)
 253                 return log_error_errno(r, "Failed to enumerate cgroup controllers: %m");
 254
 255         for (;;) {
 256                 _cleanup_free_ char *options = NULL, *controller = NULL, *where = NULL;
 257                 MountPoint p = {
 258                         .what = "cgroup",
 259                         .type = "cgroup",
 260                         .flags = MS_NOSUID|MS_NOEXEC|MS_NODEV,
 261                         .mode = MNT_IN_CONTAINER,
 262                 };
 263                 char ***k = NULL;
 264
 265                 controller = set_steal_first(controllers);
 266                 if (!controller)
 267                         break;
 268
 269                 if (join_controllers)
 270                         for (k = join_controllers; *k; k++)
 271                                 if (strv_find(*k, controller))
 272                                         break;
 273
 274                 if (k && *k) {
 275                         char **i, **j;
 276
 277                         for (i = *k, j = *k; *i; i++) {
 278
 279                                 if (!streq(*i, controller)) {
 280                                         _cleanup_free_ char *t;
 281
 282                                         t = set_remove(controllers, *i);
 283                                         if (!t) {
 284                                                 free(*i);
 285                                                 continue;
 286                                         }
 287                                 }
 288
 289                                 *(j++) = *i;
 290                         }
 291
 292                         *j = NULL;
 293
 294                         options = strv_join(*k, ",");
 295                         if (!options)
 296                                 return log_oom();
 297                 } else {
 298                         options = controller;
 299                         controller = NULL;
 300                 }
 301
 302                 where = strappend("/sys/fs/cgroup/", options);
 303                 if (!where)
 304                         return log_oom();
 305
 306                 p.where = where;
 307                 p.options = options;
 308
 309                 r = mount_one(&p, true);
 310                 if (r < 0)
 311                         return r;
 312
 313                 if (r > 0 && k && *k) {
 314                         char **i;
 315
 316                         for (i = *k; *i; i++) {
 317                                 _cleanup_free_ char *t = NULL;
 318
 319                                 t = strappend("/sys/fs/cgroup/", *i);
 320                                 if (!t)
 321                                         return log_oom();
 322
 323                                 r = symlink(options, t);
 324                                 if (r >= 0) {
 325 #ifdef SMACK_RUN_LABEL
 326                                         _cleanup_free_ char *src;
 327                                         src = strappend("/sys/fs/cgroup/", options);
 328                                         if (!src)
 329                                                 return log_oom();
 330                                         r = mac_smack_copy(t, src);
 331                                         if (r < 0 && r != -EOPNOTSUPP)
 332                                                 return log_error_errno(r, "Failed to copy smack label from %s to %s: %m", src, t);
 333 #endif
 334                                 } else if (errno != EEXIST)
 335                                         return log_error_errno(errno, "Failed to create symlink %s: %m", t);
 336                         }
 337                 }
 338         }
 339
 340         /* Now that we mounted everything, let's make the tmpfs the
 341          * cgroup file systems are mounted into read-only. */
 342         (void) mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
 343
 344         return 0;
 345 }
 346
 347 #if HAVE_SELINUX || ENABLE_SMACK
 348 static int nftw_cb(
 349                 const char *fpath,
 350                 const struct stat *sb,
 351                 int tflag,
 352                 struct FTW *ftwbuf) {
 353
 354         /* No need to label /dev twice in a row... */
 355         if (_unlikely_(ftwbuf->level == 0))
 356                 return FTW_CONTINUE;
 357
 358         label_fix(fpath, false, false);
 359
 360         /* /run/initramfs is static data and big, no need to
 361          * dynamically relabel its contents at boot... */
 362         if (_unlikely_(ftwbuf->level == 1 &&
 363                       tflag == FTW_D &&
 364                       streq(fpath, "/run/initramfs")))
 365                 return FTW_SKIP_SUBTREE;
 366
 367         return FTW_CONTINUE;
 368 };
 369 #endif
 370
 371 int mount_setup(bool loaded_policy) {
 372         int r = 0;
 373
 374         r = mount_points_setup(ELEMENTSOF(mount_table), loaded_policy);
 375         if (r < 0)
 376                 return r;
 377
 378 #if HAVE_SELINUX || ENABLE_SMACK
 379         /* Nodes in devtmpfs and /run need to be manually updated for
 380          * the appropriate labels, after mounting. The other virtual
 381          * API file systems like /sys and /proc do not need that, they
 382          * use the same label for all their files. */
 383         if (loaded_policy) {
 384                 usec_t before_relabel, after_relabel;
 385                 char timespan[FORMAT_TIMESPAN_MAX];
 386
 387                 before_relabel = now(CLOCK_MONOTONIC);
 388
 389                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 390                 nftw("/dev/shm", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 391                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 392
 393                 /* Temporarily remount the root cgroup filesystem to give it a proper label. */
 394                 r = cg_all_unified();
 395                 if (r == 0) {
 396                         (void) mount(NULL, "/sys/fs/cgroup", NULL, MS_REMOUNT, NULL);
 397                         label_fix("/sys/fs/cgroup", false, false);
 398                         nftw("/sys/fs/cgroup", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 399                         (void) mount(NULL, "/sys/fs/cgroup", NULL, MS_REMOUNT|MS_RDONLY, NULL);
 400                 } else if (r < 0)
 401                         return log_error_errno(r, "Failed to determine whether we are in all unified mode: %m");
 402
 403                 after_relabel = now(CLOCK_MONOTONIC);
 404
 405                 log_info("Relabelled /dev, /run and /sys/fs/cgroup in %s.",
 406                          format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
 407         }
 408 #endif
 409
 410         /* Create a few default symlinks, which are normally created
 411          * by udevd, but some scripts might need them before we start
 412          * udevd. */
 413         dev_setup(NULL, UID_INVALID, GID_INVALID);
 414
 415         /* Mark the root directory as shared in regards to mount propagation. The kernel defaults to "private", but we
 416          * think it makes more sense to have a default of "shared" so that nspawn and the container tools work out of
 417          * the box. If specific setups need other settings they can reset the propagation mode to private if
 418          * needed. Note that we set this only when we are invoked directly by the kernel. If we are invoked by a
 419          * container manager we assume the container manager knows what it is doing (for example, because it set up
 420          * some directories with different propagation modes). */
 421         if (detect_container() <= 0)
 422                 if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
 423                         log_warning_errno(errno, "Failed to set up the root directory for shared mount propagation: %m");
 424
 425         /* Create a few directories we always want around, Note that sd_booted() checks for /run/systemd/system, so
 426          * this mkdir really needs to stay for good, otherwise software that copied sd-daemon.c into their sources will
 427          * misdetect systemd. */
 428         (void) mkdir_label("/run/systemd", 0755);
 429         (void) mkdir_label("/run/systemd/system", 0755);
 430
 431         /* Set up inaccessible items */
 432         (void) mkdir_label("/run/systemd/inaccessible", 0000);
 433         (void) mknod("/run/systemd/inaccessible/reg", S_IFREG | 0000, 0);
 434         (void) mkdir_label("/run/systemd/inaccessible/dir", 0000);
 435         (void) mknod("/run/systemd/inaccessible/chr", S_IFCHR | 0000, makedev(0, 0));
 436         (void) mknod("/run/systemd/inaccessible/blk", S_IFBLK | 0000, makedev(0, 0));
 437         (void) mkfifo("/run/systemd/inaccessible/fifo", 0000);
 438         (void) mknod("/run/systemd/inaccessible/sock", S_IFSOCK | 0000, 0);
 439
 440         return 0;
 441 }