1 /* SPDX-License-Identifier: LGPL-2.1+ */
5 This file is part of systemd.
7 Copyright 2010 Lennart Poettering
8 Copyright 2016 Djalal Harouni
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 typedef struct NamespaceInfo NamespaceInfo
;
25 typedef struct BindMount BindMount
;
29 #include "dissect-image.h"
32 typedef enum ProtectHome
{
35 PROTECT_HOME_READ_ONLY
,
37 _PROTECT_HOME_INVALID
= -1
40 typedef enum NamespaceType
{
49 _NAMESPACE_TYPE_INVALID
= -1,
52 typedef enum ProtectSystem
{
56 PROTECT_SYSTEM_STRICT
,
58 _PROTECT_SYSTEM_INVALID
= -1
61 struct NamespaceInfo
{
62 bool ignore_protect_paths
:1;
64 bool protect_control_groups
:1;
65 bool protect_kernel_tunables
:1;
66 bool protect_kernel_modules
:1;
79 const char *root_directory
,
80 const char *root_image
,
81 const NamespaceInfo
*ns_info
,
82 char **read_write_paths
,
83 char **read_only_paths
,
84 char **inaccessible_paths
,
85 char **empty_directories
,
86 const BindMount
*bind_mounts
,
87 unsigned n_bind_mounts
,
89 const char *var_tmp_dir
,
90 ProtectHome protect_home
,
91 ProtectSystem protect_system
,
92 unsigned long mount_flags
,
93 DissectImageFlags dissected_image_flags
);
100 int setup_netns(int netns_storage_socket
[2]);
102 const char* protect_home_to_string(ProtectHome p
) _const_
;
103 ProtectHome
protect_home_from_string(const char *s
) _pure_
;
104 ProtectHome
parse_protect_home_or_bool(const char *s
);
106 const char* protect_system_to_string(ProtectSystem p
) _const_
;
107 ProtectSystem
protect_system_from_string(const char *s
) _pure_
;
108 ProtectSystem
parse_protect_system_or_bool(const char *s
);
110 void bind_mount_free_many(BindMount
*b
, unsigned n
);
111 int bind_mount_add(BindMount
**b
, unsigned *n
, const BindMount
*item
);
113 const char* namespace_type_to_string(NamespaceType t
) _const_
;
114 NamespaceType
namespace_type_from_string(const char *s
) _pure_
;
116 bool ns_type_supported(NamespaceType type
);