src/core/mount-setup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2010 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <errno.h>
  22 #include <ftw.h>
  23 #include <stdlib.h>
  24 #include <sys/mount.h>
  25 #include <unistd.h>
  26
  27 #include "alloc-util.h"
  28 #include "bus-util.h"
  29 #include "cgroup-util.h"
  30 #include "dev-setup.h"
  31 #include "efivars.h"
  32 #include "fileio.h"
  33 #include "fs-util.h"
  34 #include "label.h"
  35 #include "log.h"
  36 #include "macro.h"
  37 #include "missing.h"
  38 #include "mkdir.h"
  39 #include "mount-setup.h"
  40 #include "mount-util.h"
  41 #include "path-util.h"
  42 #include "set.h"
  43 #include "smack-util.h"
  44 #include "strv.h"
  45 #include "user-util.h"
  46 #include "util.h"
  47 #include "virt.h"
  48
  49 typedef enum MountMode {
  50         MNT_NONE  =           0,
  51         MNT_FATAL =           1 <<  0,
  52         MNT_IN_CONTAINER =    1 <<  1,
  53         MNT_CHECK_WRITABLE  = 1 <<  2,
  54 } MountMode;
  55
  56 typedef struct MountPoint {
  57         const char *what;
  58         const char *where;
  59         const char *type;
  60         const char *options;
  61         unsigned long flags;
  62         bool (*condition_fn)(void);
  63         MountMode mode;
  64 } MountPoint;
  65
  66 /* The first three entries we might need before SELinux is up. The
  67  * fourth (securityfs) is needed by IMA to load a custom policy. The
  68  * other ones we can delay until SELinux and IMA are loaded. When
  69  * SMACK is enabled we need smackfs, too, so it's a fifth one. */
  70 #if ENABLE_SMACK
  71 #define N_EARLY_MOUNT 5
  72 #else
  73 #define N_EARLY_MOUNT 4
  74 #endif
  75
  76 static const MountPoint mount_table[] = {
  77         { "sysfs",       "/sys",                      "sysfs",      NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  78           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  79         { "proc",        "/proc",                     "proc",       NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  80           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  81         { "devtmpfs",    "/dev",                      "devtmpfs",   "mode=755",                MS_NOSUID|MS_STRICTATIME,
  82           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  83         { "securityfs",  "/sys/kernel/security",      "securityfs", NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  84           NULL,          MNT_NONE                   },
  85 #if ENABLE_SMACK
  86         { "smackfs",     "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*",            MS_NOSUID|MS_NOEXEC|MS_NODEV,
  87           mac_smack_use, MNT_FATAL                  },
  88         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  89           mac_smack_use, MNT_FATAL                  },
  90 #endif
  91         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777",               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  92           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  93         { "devpts",      "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
  94           NULL,          MNT_IN_CONTAINER           },
  95 #if ENABLE_SMACK
  96         { "tmpfs",       "/run",                      "tmpfs",      "mode=755,smackfsroot=*",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  97           mac_smack_use, MNT_FATAL                  },
  98 #endif
  99         { "tmpfs",       "/run",                      "tmpfs",      "mode=755",                MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 100           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
 101         { "cgroup",      "/sys/fs/cgroup",            "cgroup2",    "nsdelegate",              MS_NOSUID|MS_NOEXEC|MS_NODEV,
 102           cg_is_unified_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
 103         { "cgroup",      "/sys/fs/cgroup",            "cgroup2",    NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 104           cg_is_unified_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
 105         { "tmpfs",       "/sys/fs/cgroup",            "tmpfs",      "mode=755",                MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
 106           cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 107         { "cgroup",      "/sys/fs/cgroup/unified",    "cgroup2",    "nsdelegate",              MS_NOSUID|MS_NOEXEC|MS_NODEV,
 108           cg_is_hybrid_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
 109         { "cgroup",      "/sys/fs/cgroup/unified",    "cgroup2",    NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 110           cg_is_hybrid_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
 111         { "cgroup",      "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
 112           cg_is_legacy_wanted, MNT_IN_CONTAINER     },
 113         { "cgroup",      "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd",       MS_NOSUID|MS_NOEXEC|MS_NODEV,
 114           cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 115         { "pstore",      "/sys/fs/pstore",            "pstore",     NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 116           NULL,          MNT_NONE                   },
 117 #if ENABLE_EFI
 118         { "efivarfs",    "/sys/firmware/efi/efivars", "efivarfs",   NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 119           is_efi_boot,   MNT_NONE                   },
 120 #endif
 121 };
 122
 123 /* These are API file systems that might be mounted by other software,
 124  * we just list them here so that we know that we should ignore them */
 125
 126 static const char ignore_paths[] =
 127         /* SELinux file systems */
 128         "/sys/fs/selinux\0"
 129         /* Container bind mounts */
 130         "/proc/sys\0"
 131         "/dev/console\0"
 132         "/proc/kmsg\0";
 133
 134 bool mount_point_is_api(const char *path) {
 135         unsigned i;
 136
 137         /* Checks if this mount point is considered "API", and hence
 138          * should be ignored */
 139
 140         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
 141                 if (path_equal(path, mount_table[i].where))
 142                         return true;
 143
 144         return path_startswith(path, "/sys/fs/cgroup/");
 145 }
 146
 147 bool mount_point_ignore(const char *path) {
 148         const char *i;
 149
 150         NULSTR_FOREACH(i, ignore_paths)
 151                 if (path_equal(path, i))
 152                         return true;
 153
 154         return false;
 155 }
 156
 157 static int mount_one(const MountPoint *p, bool relabel) {
 158         int r, priority;
 159
 160         assert(p);
 161
 162         priority = (p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG;
 163
 164         if (p->condition_fn && !p->condition_fn())
 165                 return 0;
 166
 167         /* Relabel first, just in case */
 168         if (relabel)
 169                 (void) label_fix(p->where, true, true);
 170
 171         r = path_is_mount_point(p->where, NULL, AT_SYMLINK_FOLLOW);
 172         if (r < 0 && r != -ENOENT) {
 173                 log_full_errno(priority, r, "Failed to determine whether %s is a mount point: %m", p->where);
 174                 return (p->mode & MNT_FATAL) ? r : 0;
 175         }
 176         if (r > 0)
 177                 return 0;
 178
 179         /* Skip securityfs in a container */
 180         if (!(p->mode & MNT_IN_CONTAINER) && detect_container() > 0)
 181                 return 0;
 182
 183         /* The access mode here doesn't really matter too much, since
 184          * the mounted file system will take precedence anyway. */
 185         if (relabel)
 186                 (void) mkdir_p_label(p->where, 0755);
 187         else
 188                 (void) mkdir_p(p->where, 0755);
 189
 190         log_debug("Mounting %s to %s of type %s with options %s.",
 191                   p->what,
 192                   p->where,
 193                   p->type,
 194                   strna(p->options));
 195
 196         if (mount(p->what,
 197                   p->where,
 198                   p->type,
 199                   p->flags,
 200                   p->options) < 0) {
 201                 log_full_errno(priority, errno, "Failed to mount %s at %s: %m", p->type, p->where);
 202                 return (p->mode & MNT_FATAL) ? -errno : 0;
 203         }
 204
 205         /* Relabel again, since we now mounted something fresh here */
 206         if (relabel)
 207                 (void) label_fix(p->where, false, false);
 208
 209         if (p->mode & MNT_CHECK_WRITABLE) {
 210                 if (access(p->where, W_OK) < 0) {
 211                         r = -errno;
 212
 213                         (void) umount(p->where);
 214                         (void) rmdir(p->where);
 215
 216                         log_full_errno(priority, r, "Mount point %s not writable after mounting: %m", p->where);
 217                         return (p->mode & MNT_FATAL) ? r : 0;
 218                 }
 219         }
 220
 221         return 1;
 222 }
 223
 224 static int mount_points_setup(unsigned n, bool loaded_policy) {
 225         unsigned i;
 226         int r = 0;
 227
 228         for (i = 0; i < n; i ++) {
 229                 int j;
 230
 231                 j = mount_one(mount_table + i, loaded_policy);
 232                 if (j != 0 && r >= 0)
 233                         r = j;
 234         }
 235
 236         return r;
 237 }
 238
 239 int mount_setup_early(void) {
 240         assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));
 241
 242         /* Do a minimal mount of /proc and friends to enable the most
 243          * basic stuff, such as SELinux */
 244         return mount_points_setup(N_EARLY_MOUNT, false);
 245 }
 246
 247 int mount_cgroup_controllers(char ***join_controllers) {
 248         _cleanup_set_free_free_ Set *controllers = NULL;
 249         int r;
 250
 251         if (!cg_is_legacy_wanted())
 252                 return 0;
 253
 254         /* Mount all available cgroup controllers that are built into the kernel. */
 255
 256         r = cg_kernel_controllers(&controllers);
 257         if (r < 0)
 258                 return log_error_errno(r, "Failed to enumerate cgroup controllers: %m");
 259
 260         for (;;) {
 261                 _cleanup_free_ char *options = NULL, *controller = NULL, *where = NULL;
 262                 MountPoint p = {
 263                         .what = "cgroup",
 264                         .type = "cgroup",
 265                         .flags = MS_NOSUID|MS_NOEXEC|MS_NODEV,
 266                         .mode = MNT_IN_CONTAINER,
 267                 };
 268                 char ***k = NULL;
 269
 270                 controller = set_steal_first(controllers);
 271                 if (!controller)
 272                         break;
 273
 274                 if (join_controllers)
 275                         for (k = join_controllers; *k; k++)
 276                                 if (strv_find(*k, controller))
 277                                         break;
 278
 279                 if (k && *k) {
 280                         char **i, **j;
 281
 282                         for (i = *k, j = *k; *i; i++) {
 283
 284                                 if (!streq(*i, controller)) {
 285                                         _cleanup_free_ char *t;
 286
 287                                         t = set_remove(controllers, *i);
 288                                         if (!t) {
 289                                                 free(*i);
 290                                                 continue;
 291                                         }
 292                                 }
 293
 294                                 *(j++) = *i;
 295                         }
 296
 297                         *j = NULL;
 298
 299                         options = strv_join(*k, ",");
 300                         if (!options)
 301                                 return log_oom();
 302                 } else {
 303                         options = controller;
 304                         controller = NULL;
 305                 }
 306
 307                 where = strappend("/sys/fs/cgroup/", options);
 308                 if (!where)
 309                         return log_oom();
 310
 311                 p.where = where;
 312                 p.options = options;
 313
 314                 r = mount_one(&p, true);
 315                 if (r < 0)
 316                         return r;
 317
 318                 if (r > 0 && k && *k) {
 319                         char **i;
 320
 321                         for (i = *k; *i; i++) {
 322                                 _cleanup_free_ char *t = NULL;
 323
 324                                 t = strappend("/sys/fs/cgroup/", *i);
 325                                 if (!t)
 326                                         return log_oom();
 327
 328                                 r = symlink(options, t);
 329                                 if (r >= 0) {
 330 #ifdef SMACK_RUN_LABEL
 331                                         _cleanup_free_ char *src;
 332                                         src = strappend("/sys/fs/cgroup/", options);
 333                                         if (!src)
 334                                                 return log_oom();
 335                                         r = mac_smack_copy(t, src);
 336                                         if (r < 0 && r != -EOPNOTSUPP)
 337                                                 return log_error_errno(r, "Failed to copy smack label from %s to %s: %m", src, t);
 338 #endif
 339                                 } else if (errno != EEXIST)
 340                                         return log_error_errno(errno, "Failed to create symlink %s: %m", t);
 341                         }
 342                 }
 343         }
 344
 345         /* Now that we mounted everything, let's make the tmpfs the
 346          * cgroup file systems are mounted into read-only. */
 347         (void) mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
 348
 349         return 0;
 350 }
 351
 352 #if HAVE_SELINUX || ENABLE_SMACK
 353 static int nftw_cb(
 354                 const char *fpath,
 355                 const struct stat *sb,
 356                 int tflag,
 357                 struct FTW *ftwbuf) {
 358
 359         /* No need to label /dev twice in a row... */
 360         if (_unlikely_(ftwbuf->level == 0))
 361                 return FTW_CONTINUE;
 362
 363         label_fix(fpath, false, false);
 364
 365         /* /run/initramfs is static data and big, no need to
 366          * dynamically relabel its contents at boot... */
 367         if (_unlikely_(ftwbuf->level == 1 &&
 368                       tflag == FTW_D &&
 369                       streq(fpath, "/run/initramfs")))
 370                 return FTW_SKIP_SUBTREE;
 371
 372         return FTW_CONTINUE;
 373 };
 374 #endif
 375
 376 int mount_setup(bool loaded_policy) {
 377         int r = 0;
 378
 379         r = mount_points_setup(ELEMENTSOF(mount_table), loaded_policy);
 380         if (r < 0)
 381                 return r;
 382
 383 #if HAVE_SELINUX || ENABLE_SMACK
 384         /* Nodes in devtmpfs and /run need to be manually updated for
 385          * the appropriate labels, after mounting. The other virtual
 386          * API file systems like /sys and /proc do not need that, they
 387          * use the same label for all their files. */
 388         if (loaded_policy) {
 389                 usec_t before_relabel, after_relabel;
 390                 char timespan[FORMAT_TIMESPAN_MAX];
 391
 392                 before_relabel = now(CLOCK_MONOTONIC);
 393
 394                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 395                 nftw("/dev/shm", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 396                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 397
 398                 /* Temporarily remount the root cgroup filesystem to give it a proper label. */
 399                 r = cg_all_unified();
 400                 if (r == 0) {
 401                         (void) mount(NULL, "/sys/fs/cgroup", NULL, MS_REMOUNT, NULL);
 402                         label_fix("/sys/fs/cgroup", false, false);
 403                         nftw("/sys/fs/cgroup", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 404                         (void) mount(NULL, "/sys/fs/cgroup", NULL, MS_REMOUNT|MS_RDONLY, NULL);
 405                 } else if (r < 0)
 406                         return log_error_errno(r, "Failed to determine whether we are in all unified mode: %m");
 407
 408                 after_relabel = now(CLOCK_MONOTONIC);
 409
 410                 log_info("Relabelled /dev, /run and /sys/fs/cgroup in %s.",
 411                          format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
 412         }
 413 #endif
 414
 415         /* Create a few default symlinks, which are normally created
 416          * by udevd, but some scripts might need them before we start
 417          * udevd. */
 418         dev_setup(NULL, UID_INVALID, GID_INVALID);
 419
 420         /* Mark the root directory as shared in regards to mount propagation. The kernel defaults to "private", but we
 421          * think it makes more sense to have a default of "shared" so that nspawn and the container tools work out of
 422          * the box. If specific setups need other settings they can reset the propagation mode to private if
 423          * needed. Note that we set this only when we are invoked directly by the kernel. If we are invoked by a
 424          * container manager we assume the container manager knows what it is doing (for example, because it set up
 425          * some directories with different propagation modes). */
 426         if (detect_container() <= 0)
 427                 if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
 428                         log_warning_errno(errno, "Failed to set up the root directory for shared mount propagation: %m");
 429
 430         /* Create a few directories we always want around, Note that sd_booted() checks for /run/systemd/system, so
 431          * this mkdir really needs to stay for good, otherwise software that copied sd-daemon.c into their sources will
 432          * misdetect systemd. */
 433         (void) mkdir_label("/run/systemd", 0755);
 434         (void) mkdir_label("/run/systemd/system", 0755);
 435
 436         /* Set up inaccessible items */
 437         (void) mkdir_label("/run/systemd/inaccessible", 0000);
 438         (void) mknod("/run/systemd/inaccessible/reg", S_IFREG | 0000, 0);
 439         (void) mkdir_label("/run/systemd/inaccessible/dir", 0000);
 440         (void) mknod("/run/systemd/inaccessible/chr", S_IFCHR | 0000, makedev(0, 0));
 441         (void) mknod("/run/systemd/inaccessible/blk", S_IFBLK | 0000, makedev(0, 0));
 442         (void) mkfifo("/run/systemd/inaccessible/fifo", 0000);
 443         (void) mknod("/run/systemd/inaccessible/sock", S_IFSOCK | 0000, 0);
 444
 445         return 0;
 446 }