src/home/homework-directory.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <sys/mount.h>
   4
   5 #include "btrfs-util.h"
   6 #include "fd-util.h"
   7 #include "homework-directory.h"
   8 #include "homework-quota.h"
   9 #include "mkdir.h"
  10 #include "mount-util.h"
  11 #include "path-util.h"
  12 #include "rm-rf.h"
  13 #include "tmpfile-util.h"
  14 #include "umask-util.h"
  15
  16 int home_setup_directory(UserRecord *h, HomeSetup *setup) {
  17         assert(h);
  18         assert(setup);
  19
  20         setup->root_fd = open(user_record_image_path(h), O_RDONLY|O_CLOEXEC|O_DIRECTORY);
  21         if (setup->root_fd < 0)
  22                 return log_error_errno(errno, "Failed to open home directory: %m");
  23
  24         return 0;
  25 }
  26
  27 int home_activate_directory(
  28                 UserRecord *h,
  29                 HomeSetup *setup,
  30                 PasswordCache *cache,
  31                 UserRecord **ret_home) {
  32
  33         _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *header_home = NULL;
  34         const char *hdo, *hd, *ipo, *ip;
  35         int r;
  36
  37         assert(h);
  38         assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
  39         assert(setup);
  40         assert(ret_home);
  41
  42         assert_se(ipo = user_record_image_path(h));
  43         ip = strdupa_safe(ipo); /* copy out, since reconciliation might cause changing of the field */
  44
  45         assert_se(hdo = user_record_home_directory(h));
  46         hd = strdupa_safe(hdo);
  47
  48         r = home_setup(h, 0, cache, setup, &header_home);
  49         if (r < 0)
  50                 return r;
  51
  52         r = home_refresh(h, setup, header_home, cache, NULL, &new_home);
  53         if (r < 0)
  54                 return r;
  55
  56         setup->root_fd = safe_close(setup->root_fd);
  57
  58         /* Create mount point to mount over if necessary */
  59         if (!path_equal(ip, hd))
  60                 (void) mkdir_p(hd, 0700);
  61
  62         /* Create a mount point (even if the directory is already placed correctly), as a way to indicate
  63          * this mount point is now "activated". Moreover, we want to set per-user
  64          * MS_NOSUID/MS_NOEXEC/MS_NODEV. */
  65         r = mount_nofollow_verbose(LOG_ERR, ip, hd, NULL, MS_BIND, NULL);
  66         if (r < 0)
  67                 return r;
  68
  69         r = mount_nofollow_verbose(LOG_ERR, NULL, hd, NULL, MS_BIND|MS_REMOUNT|user_record_mount_flags(h), NULL);
  70         if (r < 0) {
  71                 (void) umount_verbose(LOG_ERR, hd, UMOUNT_NOFOLLOW);
  72                 return r;
  73         }
  74
  75         log_info("Everything completed.");
  76
  77         *ret_home = TAKE_PTR(new_home);
  78         return 0;
  79 }
  80
  81 int home_create_directory_or_subvolume(UserRecord *h, UserRecord **ret_home) {
  82         _cleanup_(rm_rf_subvolume_and_freep) char *temporary = NULL;
  83         _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
  84         _cleanup_close_ int root_fd = -1;
  85         _cleanup_free_ char *d = NULL;
  86         const char *ip;
  87         int r;
  88
  89         assert(h);
  90         assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME));
  91         assert(ret_home);
  92
  93         assert_se(ip = user_record_image_path(h));
  94
  95         r = tempfn_random(ip, "homework", &d);
  96         if (r < 0)
  97                 return log_error_errno(r, "Failed to allocate temporary directory: %m");
  98
  99         (void) mkdir_parents(d, 0755);
 100
 101         switch (user_record_storage(h)) {
 102
 103         case USER_SUBVOLUME:
 104                 RUN_WITH_UMASK(0077)
 105                         r = btrfs_subvol_make(d);
 106
 107                 if (r >= 0) {
 108                         log_info("Subvolume created.");
 109
 110                         if (h->disk_size != UINT64_MAX) {
 111
 112                                 /* Enable quota for the subvolume we just created. Note we don't check for
 113                                  * errors here and only log about debug level about this. */
 114                                 r = btrfs_quota_enable(d, true);
 115                                 if (r < 0)
 116                                         log_debug_errno(r, "Failed to enable quota on %s, ignoring: %m", d);
 117
 118                                 r = btrfs_subvol_auto_qgroup(d, 0, false);
 119                                 if (r < 0)
 120                                         log_debug_errno(r, "Failed to set up automatic quota group on %s, ignoring: %m", d);
 121
 122                                 /* Actually configure the quota. We also ignore errors here, but we do log
 123                                  * about them loudly, to keep things discoverable even though we don't
 124                                  * consider lacking quota support in kernel fatal. */
 125                                 (void) home_update_quota_btrfs(h, d);
 126                         }
 127
 128                         break;
 129                 }
 130                 if (r != -ENOTTY)
 131                         return log_error_errno(r, "Failed to create temporary home directory subvolume %s: %m", d);
 132
 133                 log_info("Creating subvolume %s is not supported, as file system does not support subvolumes. Falling back to regular directory.", d);
 134                 _fallthrough_;
 135
 136         case USER_DIRECTORY:
 137
 138                 if (mkdir(d, 0700) < 0)
 139                         return log_error_errno(errno, "Failed to create temporary home directory %s: %m", d);
 140
 141                 (void) home_update_quota_classic(h, d);
 142                 break;
 143
 144         default:
 145                 assert_not_reached();
 146         }
 147
 148         temporary = TAKE_PTR(d); /* Needs to be destroyed now */
 149
 150         root_fd = open(temporary, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
 151         if (root_fd < 0)
 152                 return log_error_errno(errno, "Failed to open temporary home directory: %m");
 153
 154         r = home_populate(h, root_fd);
 155         if (r < 0)
 156                 return r;
 157
 158         r = home_sync_and_statfs(root_fd, NULL);
 159         if (r < 0)
 160                 return r;
 161
 162         r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, &new_home);
 163         if (r < 0)
 164                 return log_error_errno(r, "Failed to clone record: %m");
 165
 166         r = user_record_add_binding(
 167                         new_home,
 168                         user_record_storage(h),
 169                         ip,
 170                         SD_ID128_NULL,
 171                         SD_ID128_NULL,
 172                         SD_ID128_NULL,
 173                         NULL,
 174                         NULL,
 175                         UINT64_MAX,
 176                         NULL,
 177                         NULL,
 178                         h->uid,
 179                         (gid_t) h->uid);
 180         if (r < 0)
 181                 return log_error_errno(r, "Failed to add binding to record: %m");
 182
 183         if (rename(temporary, ip) < 0)
 184                 return log_error_errno(errno, "Failed to rename %s to %s: %m", temporary, ip);
 185
 186         temporary = mfree(temporary);
 187
 188         log_info("Everything completed.");
 189
 190         *ret_home = TAKE_PTR(new_home);
 191         return 0;
 192 }
 193
 194 int home_resize_directory(
 195                 UserRecord *h,
 196                 HomeSetupFlags flags,
 197                 PasswordCache *cache,
 198                 HomeSetup *setup,
 199                 UserRecord **ret_home) {
 200
 201         _cleanup_(user_record_unrefp) UserRecord *embedded_home = NULL, *new_home = NULL;
 202         int r;
 203
 204         assert(h);
 205         assert(setup);
 206         assert(ret_home);
 207         assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
 208
 209         r = home_setup(h, flags, cache, setup, NULL);
 210         if (r < 0)
 211                 return r;
 212
 213         r = home_load_embedded_identity(h, setup->root_fd, NULL, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
 214         if (r < 0)
 215                 return r;
 216
 217         r = home_update_quota_auto(h, NULL);
 218         if (ERRNO_IS_NOT_SUPPORTED(r))
 219                 return -ESOCKTNOSUPPORT; /* make recognizable */
 220         if (r < 0)
 221                 return r;
 222
 223         r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
 224         if (r < 0)
 225                 return r;
 226
 227         r = home_extend_embedded_identity(new_home, h, setup);
 228         if (r < 0)
 229                 return r;
 230
 231         r = home_sync_and_statfs(setup->root_fd, NULL);
 232         if (r < 0)
 233                 return r;
 234
 235         r = home_setup_done(setup);
 236         if (r < 0)
 237                 return r;
 238
 239         log_info("Everything completed.");
 240
 241         *ret_home = TAKE_PTR(new_home);
 242         return 0;
 243 }