src/home/homework-directory.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <sys/mount.h>
   4
   5 #include "btrfs-util.h"
   6 #include "fd-util.h"
   7 #include "homework-directory.h"
   8 #include "homework-quota.h"
   9 #include "mkdir.h"
  10 #include "mount-util.h"
  11 #include "path-util.h"
  12 #include "rm-rf.h"
  13 #include "tmpfile-util.h"
  14 #include "umask-util.h"
  15
  16 int home_setup_directory(UserRecord *h, HomeSetup *setup) {
  17         assert(h);
  18         assert(setup);
  19
  20         setup->root_fd = open(user_record_image_path(h), O_RDONLY|O_CLOEXEC|O_DIRECTORY);
  21         if (setup->root_fd < 0)
  22                 return log_error_errno(errno, "Failed to open home directory: %m");
  23
  24         return 0;
  25 }
  26
  27 int home_activate_directory(
  28                 UserRecord *h,
  29                 HomeSetup *setup,
  30                 PasswordCache *cache,
  31                 UserRecord **ret_home) {
  32
  33         _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *header_home = NULL;
  34         const char *hdo, *hd, *ipo, *ip;
  35         int r;
  36
  37         assert(h);
  38         assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
  39         assert(setup);
  40         assert(ret_home);
  41
  42         assert_se(ipo = user_record_image_path(h));
  43         ip = strdupa_safe(ipo); /* copy out, since reconciliation might cause changing of the field */
  44
  45         assert_se(hdo = user_record_home_directory(h));
  46         hd = strdupa_safe(hdo);
  47
  48         r = home_setup(h, 0, cache, setup, &header_home);
  49         if (r < 0)
  50                 return r;
  51
  52         r = home_refresh(h, setup, header_home, cache, NULL, &new_home);
  53         if (r < 0)
  54                 return r;
  55
  56         setup->root_fd = safe_close(setup->root_fd);
  57
  58         /* Create mount point to mount over if necessary */
  59         if (!path_equal(ip, hd))
  60                 (void) mkdir_p(hd, 0700);
  61
  62         /* Create a mount point (even if the directory is already placed correctly), as a way to indicate
  63          * this mount point is now "activated". Moreover, we want to set per-user
  64          * MS_NOSUID/MS_NOEXEC/MS_NODEV. */
  65         r = mount_nofollow_verbose(LOG_ERR, ip, hd, NULL, MS_BIND, NULL);
  66         if (r < 0)
  67                 return r;
  68
  69         r = mount_nofollow_verbose(LOG_ERR, NULL, hd, NULL, MS_BIND|MS_REMOUNT|user_record_mount_flags(h), NULL);
  70         if (r < 0) {
  71                 (void) umount_verbose(LOG_ERR, hd, UMOUNT_NOFOLLOW);
  72                 return r;
  73         }
  74
  75         setup->do_drop_caches = false;
  76
  77         log_info("Everything completed.");
  78
  79         *ret_home = TAKE_PTR(new_home);
  80         return 0;
  81 }
  82
  83 int home_create_directory_or_subvolume(UserRecord *h, HomeSetup *setup, UserRecord **ret_home) {
  84         _cleanup_(rm_rf_subvolume_and_freep) char *temporary = NULL;
  85         _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
  86         _cleanup_free_ char *d = NULL;
  87         const char *ip;
  88         int r;
  89
  90         assert(h);
  91         assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME));
  92         assert(setup);
  93         assert(ret_home);
  94
  95         assert_se(ip = user_record_image_path(h));
  96
  97         r = tempfn_random(ip, "homework", &d);
  98         if (r < 0)
  99                 return log_error_errno(r, "Failed to allocate temporary directory: %m");
 100
 101         (void) mkdir_parents(d, 0755);
 102
 103         switch (user_record_storage(h)) {
 104
 105         case USER_SUBVOLUME:
 106                 RUN_WITH_UMASK(0077)
 107                         r = btrfs_subvol_make(d);
 108
 109                 if (r >= 0) {
 110                         log_info("Subvolume created.");
 111
 112                         if (h->disk_size != UINT64_MAX) {
 113
 114                                 /* Enable quota for the subvolume we just created. Note we don't check for
 115                                  * errors here and only log about debug level about this. */
 116                                 r = btrfs_quota_enable(d, true);
 117                                 if (r < 0)
 118                                         log_debug_errno(r, "Failed to enable quota on %s, ignoring: %m", d);
 119
 120                                 r = btrfs_subvol_auto_qgroup(d, 0, false);
 121                                 if (r < 0)
 122                                         log_debug_errno(r, "Failed to set up automatic quota group on %s, ignoring: %m", d);
 123
 124                                 /* Actually configure the quota. We also ignore errors here, but we do log
 125                                  * about them loudly, to keep things discoverable even though we don't
 126                                  * consider lacking quota support in kernel fatal. */
 127                                 (void) home_update_quota_btrfs(h, d);
 128                         }
 129
 130                         break;
 131                 }
 132                 if (r != -ENOTTY)
 133                         return log_error_errno(r, "Failed to create temporary home directory subvolume %s: %m", d);
 134
 135                 log_info("Creating subvolume %s is not supported, as file system does not support subvolumes. Falling back to regular directory.", d);
 136                 _fallthrough_;
 137
 138         case USER_DIRECTORY:
 139
 140                 if (mkdir(d, 0700) < 0)
 141                         return log_error_errno(errno, "Failed to create temporary home directory %s: %m", d);
 142
 143                 (void) home_update_quota_classic(h, d);
 144                 break;
 145
 146         default:
 147                 assert_not_reached();
 148         }
 149
 150         temporary = TAKE_PTR(d); /* Needs to be destroyed now */
 151
 152         setup->root_fd = open(temporary, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
 153         if (setup->root_fd < 0)
 154                 return log_error_errno(errno, "Failed to open temporary home directory: %m");
 155
 156         r = home_populate(h, setup->root_fd);
 157         if (r < 0)
 158                 return r;
 159
 160         r = home_sync_and_statfs(setup->root_fd, NULL);
 161         if (r < 0)
 162                 return r;
 163
 164         r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, &new_home);
 165         if (r < 0)
 166                 return log_error_errno(r, "Failed to clone record: %m");
 167
 168         r = user_record_add_binding(
 169                         new_home,
 170                         user_record_storage(h),
 171                         ip,
 172                         SD_ID128_NULL,
 173                         SD_ID128_NULL,
 174                         SD_ID128_NULL,
 175                         NULL,
 176                         NULL,
 177                         UINT64_MAX,
 178                         NULL,
 179                         NULL,
 180                         h->uid,
 181                         (gid_t) h->uid);
 182         if (r < 0)
 183                 return log_error_errno(r, "Failed to add binding to record: %m");
 184
 185         if (rename(temporary, ip) < 0)
 186                 return log_error_errno(errno, "Failed to rename %s to %s: %m", temporary, ip);
 187
 188         temporary = mfree(temporary);
 189
 190         log_info("Everything completed.");
 191
 192         *ret_home = TAKE_PTR(new_home);
 193         return 0;
 194 }
 195
 196 int home_resize_directory(
 197                 UserRecord *h,
 198                 HomeSetupFlags flags,
 199                 PasswordCache *cache,
 200                 HomeSetup *setup,
 201                 UserRecord **ret_home) {
 202
 203         _cleanup_(user_record_unrefp) UserRecord *embedded_home = NULL, *new_home = NULL;
 204         int r;
 205
 206         assert(h);
 207         assert(setup);
 208         assert(ret_home);
 209         assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
 210
 211         r = home_setup(h, flags, cache, setup, NULL);
 212         if (r < 0)
 213                 return r;
 214
 215         r = home_load_embedded_identity(h, setup->root_fd, NULL, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
 216         if (r < 0)
 217                 return r;
 218
 219         r = home_update_quota_auto(h, NULL);
 220         if (ERRNO_IS_NOT_SUPPORTED(r))
 221                 return -ESOCKTNOSUPPORT; /* make recognizable */
 222         if (r < 0)
 223                 return r;
 224
 225         r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
 226         if (r < 0)
 227                 return r;
 228
 229         r = home_extend_embedded_identity(new_home, h, setup);
 230         if (r < 0)
 231                 return r;
 232
 233         r = home_sync_and_statfs(setup->root_fd, NULL);
 234         if (r < 0)
 235                 return r;
 236
 237         r = home_setup_done(setup);
 238         if (r < 0)
 239                 return r;
 240
 241         log_info("Everything completed.");
 242
 243         *ret_home = TAKE_PTR(new_home);
 244         return 0;
 245 }