src/core/namespace.h

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 #pragma once
   3
   4 /***
   5   This file is part of systemd.
   6
   7   Copyright 2010 Lennart Poettering
   8   Copyright 2016 Djalal Harouni
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 ***/
  23
  24 typedef struct NamespaceInfo NamespaceInfo;
  25 typedef struct BindMount BindMount;
  26 typedef struct TemporaryFileSystem TemporaryFileSystem;
  27
  28 #include <stdbool.h>
  29
  30 #include "dissect-image.h"
  31 #include "macro.h"
  32
  33 typedef enum ProtectHome {
  34         PROTECT_HOME_NO,
  35         PROTECT_HOME_YES,
  36         PROTECT_HOME_READ_ONLY,
  37         PROTECT_HOME_TMPFS,
  38         _PROTECT_HOME_MAX,
  39         _PROTECT_HOME_INVALID = -1
  40 } ProtectHome;
  41
  42 typedef enum NamespaceType {
  43         NAMESPACE_MOUNT,
  44         NAMESPACE_CGROUP,
  45         NAMESPACE_UTS,
  46         NAMESPACE_IPC,
  47         NAMESPACE_USER,
  48         NAMESPACE_PID,
  49         NAMESPACE_NET,
  50         _NAMESPACE_TYPE_MAX,
  51         _NAMESPACE_TYPE_INVALID = -1,
  52 } NamespaceType;
  53
  54 typedef enum ProtectSystem {
  55         PROTECT_SYSTEM_NO,
  56         PROTECT_SYSTEM_YES,
  57         PROTECT_SYSTEM_FULL,
  58         PROTECT_SYSTEM_STRICT,
  59         _PROTECT_SYSTEM_MAX,
  60         _PROTECT_SYSTEM_INVALID = -1
  61 } ProtectSystem;
  62
  63 struct NamespaceInfo {
  64         bool ignore_protect_paths:1;
  65         bool private_dev:1;
  66         bool protect_control_groups:1;
  67         bool protect_kernel_tunables:1;
  68         bool protect_kernel_modules:1;
  69         bool mount_apivfs:1;
  70 };
  71
  72 struct BindMount {
  73         char *source;
  74         char *destination;
  75         bool read_only:1;
  76         bool recursive:1;
  77         bool ignore_enoent:1;
  78 };
  79
  80 struct TemporaryFileSystem {
  81         char *path;
  82         char *options;
  83 };
  84
  85 int setup_namespace(
  86                 const char *root_directory,
  87                 const char *root_image,
  88                 const NamespaceInfo *ns_info,
  89                 char **read_write_paths,
  90                 char **read_only_paths,
  91                 char **inaccessible_paths,
  92                 char **empty_directories,
  93                 const BindMount *bind_mounts,
  94                 unsigned n_bind_mounts,
  95                 const TemporaryFileSystem *temporary_filesystems,
  96                 unsigned n_temporary_filesystems,
  97                 const char *tmp_dir,
  98                 const char *var_tmp_dir,
  99                 ProtectHome protect_home,
 100                 ProtectSystem protect_system,
 101                 unsigned long mount_flags,
 102                 DissectImageFlags dissected_image_flags);
 103
 104 int setup_tmp_dirs(
 105                 const char *id,
 106                 char **tmp_dir,
 107                 char **var_tmp_dir);
 108
 109 int setup_netns(int netns_storage_socket[2]);
 110
 111 const char* protect_home_to_string(ProtectHome p) _const_;
 112 ProtectHome protect_home_from_string(const char *s) _pure_;
 113 ProtectHome parse_protect_home_or_bool(const char *s);
 114
 115 const char* protect_system_to_string(ProtectSystem p) _const_;
 116 ProtectSystem protect_system_from_string(const char *s) _pure_;
 117 ProtectSystem parse_protect_system_or_bool(const char *s);
 118
 119 void bind_mount_free_many(BindMount *b, unsigned n);
 120 int bind_mount_add(BindMount **b, unsigned *n, const BindMount *item);
 121
 122 void temporary_filesystem_free_many(TemporaryFileSystem *t, unsigned n);
 123 int temporary_filesystem_add(TemporaryFileSystem **t, unsigned *n,
 124                              const char *path, const char *options);
 125
 126 const char* namespace_type_to_string(NamespaceType t) _const_;
 127 NamespaceType namespace_type_from_string(const char *s) _pure_;
 128
 129 bool ns_type_supported(NamespaceType type);