src/libpakfire/mount.c

   1 /*#############################################################################
   2 #                                                                             #
   3 # Pakfire - The IPFire package management system                              #
   4 # Copyright (C) 2022 Pakfire development team                                 #
   5 #                                                                             #
   6 # This program is free software: you can redistribute it and/or modify        #
   7 # it under the terms of the GNU General Public License as published by        #
   8 # the Free Software Foundation, either version 3 of the License, or           #
   9 # (at your option) any later version.                                         #
  10 #                                                                             #
  11 # This program is distributed in the hope that it will be useful,             #
  12 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  14 # GNU General Public License for more details.                                #
  15 #                                                                             #
  16 # You should have received a copy of the GNU General Public License           #
  17 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  18 #                                                                             #
  19 #############################################################################*/
  20
  21 #include <errno.h>
  22 #include <linux/limits.h>
  23 #include <stddef.h>
  24 #include <sys/mount.h>
  25 #include <sys/stat.h>
  26 #include <sys/sysmacros.h>
  27 #include <sys/types.h>
  28
  29 // libmount
  30 #include <libmount/libmount.h>
  31
  32 #include <pakfire/arch.h>
  33 #include <pakfire/logging.h>
  34 #include <pakfire/pakfire.h>
  35 #include <pakfire/private.h>
  36 #include <pakfire/mount.h>
  37 #include <pakfire/util.h>
  38
  39 static const struct pakfire_mountpoint {
  40         const char* source;
  41         const char* target;
  42         const char* fstype;
  43         int flags;
  44         const char* options;
  45 } mountpoints[] = {
  46         // Mount a new instance of /proc
  47         { "pakfire_proc",        "proc",               "proc",
  48                 MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, },
  49
  50         // Make /proc/sys read-only (except /proc/sys/net)
  51         { "/proc/sys",           "proc/sys",           "bind",   MS_BIND|MS_REC, NULL, },
  52         { "/proc/sys/net",       "proc/sys/net",       "bind",   MS_BIND|MS_REC, NULL, },
  53         { "/proc/sys",           "proc/sys",           "bind",
  54                 MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, },
  55
  56         // Deny write access to /proc/sysrq-trigger (can be used to restart the host)
  57         { "/proc/sysrq-trigger", "proc/sysrq-trigger", "bind",   MS_BIND|MS_REC, NULL, },
  58         { "/proc/sysrq-trigger", "proc/sysrq-trigger", "bind",
  59                 MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, },
  60
  61         // Make /proc/irq read-only
  62         { "/proc/irq",           "proc/irq",           "bind",   MS_BIND|MS_REC, NULL, },
  63         { "/proc/irq",           "proc/irq",           "bind",
  64                 MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, },
  65
  66         // Make /proc/bus read-only
  67         { "/proc/bus",           "proc/bus",           "bind",   MS_BIND|MS_REC, NULL, },
  68         { "/proc/bus",           "proc/bus",           "bind",
  69                 MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, },
  70
  71         // Bind-Mount /sys ready-only
  72         { "/sys",                "sys",                "bind",   MS_BIND|MS_REC, NULL, },
  73         { "/sys",                "sys",                "bind",
  74                 MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, },
  75
  76         // Create a new /dev
  77         { "pakfire_dev",         "dev",                "tmpfs",  MS_NOSUID|MS_NOEXEC,
  78                 "mode=0755,size=4m,nr_inodes=64k", },
  79         { "pakfire_dev_pts",     "dev/pts",            "devpts", MS_NOSUID|MS_NOEXEC,
  80                 "newinstance,ptmxmode=0666,mode=620", },
  81
  82         // Create a new /dev/shm
  83         { "pakfire_dev_shm",     "dev/shm",            "tmpfs",
  84                 MS_NOSUID|MS_NODEV|MS_STRICTATIME, "mode=1777,size=1024m", },
  85
  86         // Mount /dev/mqueue
  87         { "mqueue",               "dev/mqueue",        "mqueue",
  88                 MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL },
  89
  90         // Create a new /run
  91         { "pakfire_run",          "run",               "tmpfs",  MS_NOSUID|MS_NOEXEC|MS_NODEV,
  92                 "mode=755,size=256m,nr_inodes=1k", },
  93
  94         // Create a new /tmp
  95         { "pakfire_tmp",          "tmp",               "tmpfs",
  96                 MS_NOSUID|MS_NODEV|MS_STRICTATIME, "mode=1777,size=1024m", },
  97
  98         // The end
  99         { NULL },
 100 };
 101
 102 static const struct pakfire_devnode {
 103         const char* path;
 104         int major;
 105         int minor;
 106         mode_t mode;
 107 } devnodes[] = {
 108         { "/dev/null",      1,  3, S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH, },
 109         { "/dev/zero",      1,  5, S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH, },
 110         { "/dev/full",      1,  7, S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH, },
 111         { "/dev/random",    1,  8, S_IFCHR|S_IRUSR|S_IRGRP|S_IROTH, },
 112         { "/dev/urandom",   1,  9, S_IFCHR|S_IRUSR|S_IRGRP|S_IROTH, },
 113         { "/dev/kmsg",      1, 11, S_IFCHR|S_IRUSR|S_IRGRP|S_IROTH, },
 114         { "/dev/tty",       5,  0, S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH, },
 115         { "/dev/console",   5,  1, S_IFCHR|S_IRUSR|S_IWUSR, },
 116         { "/dev/rtc0",    252,  0, S_IFCHR|S_IRUSR|S_IWUSR, },
 117         { NULL },
 118 };
 119
 120 static const struct pakfire_symlink {
 121         const char* target;
 122         const char* path;
 123 } symlinks[] = {
 124         { "/dev/pts/ptmx",   "/dev/ptmx", },
 125         { "/proc/self/fd",   "/dev/fd", },
 126         { "/proc/self/fd/0", "/dev/stdin" },
 127         { "/proc/self/fd/1", "/dev/stdout" },
 128         { "/proc/self/fd/2", "/dev/stderr" },
 129         { "/proc/kcore",     "/dev/core" },
 130         { NULL },
 131 };
 132
 133 /*
 134         Easy way to iterate through all mountpoints
 135 */
 136 static int pakfire_mount_foreach(struct pakfire* pakfire, int direction,
 137                 int (*callback)(struct pakfire* pakfire, struct libmnt_fs* fs, const void* data),
 138                 const void* data) {
 139         const char* root = pakfire_get_path(pakfire);
 140         int r = 0;
 141
 142         struct libmnt_iter* iterator = NULL;
 143         struct libmnt_table* tab = NULL;
 144         struct libmnt_fs* fs = NULL;
 145
 146         // Create an iterator
 147         iterator = mnt_new_iter(direction);
 148         if (!iterator) {
 149                 ERROR(pakfire, "Could not setup iterator: %m\n");
 150                 goto ERROR;
 151         }
 152
 153         // Read /proc/mounts
 154         tab = mnt_new_table_from_file("/proc/mounts");
 155         if (!tab) {
 156                 ERROR(pakfire, "Could not open /proc/mounts: %m\n");
 157                 goto ERROR;
 158         }
 159
 160         while (mnt_table_next_fs(tab, iterator, &fs) == 0) {
 161                 const char* target = mnt_fs_get_target(fs);
 162
 163                 // Ignore any mointpoints that don't belong to us
 164                 if (!pakfire_string_startswith(target, root))
 165                         continue;
 166
 167                 // Call the callback for each relevant mountpoint
 168                 r = callback(pakfire, fs, data);
 169                 if (r)
 170                         break;
 171         }
 172
 173 ERROR:
 174         // Tidy up
 175         if (fs)
 176                 mnt_unref_fs(fs);
 177         if (tab)
 178                 mnt_unref_table(tab);
 179         if (iterator)
 180                 mnt_free_iter(iterator);
 181
 182         return r;
 183 }
 184
 185 static int __pakfire_is_mountpoint(struct pakfire* pakfire,
 186                 struct libmnt_fs* fs, const void* data) {
 187         const char* path = (const char*)data;
 188
 189         return mnt_fs_streq_target(fs, path);
 190 }
 191
 192 int pakfire_is_mountpoint(struct pakfire* pakfire, const char* path) {
 193         return pakfire_mount_foreach(pakfire, MNT_ITER_FORWARD,
 194                 __pakfire_is_mountpoint, path);
 195 }
 196
 197 static int pakfire_mount(struct pakfire* pakfire, const char* source, const char* target,
 198                 const char* fstype, unsigned long mflags, const void* data) {
 199         const char* options = (const char*)data;
 200
 201         // Check for some basic inputs
 202         if (!source || !target) {
 203                 errno = EINVAL;
 204                 return 1;
 205         }
 206
 207         DEBUG(pakfire, "Mounting %s from %s (%s - %s)\n", target, source, fstype, options);
 208
 209         // Perform mount()
 210         int r = mount(source, target, fstype, mflags, data);
 211         if (r) {
 212                 ERROR(pakfire, "Could not mount %s: %m\n", target);
 213         }
 214
 215         return r;
 216 }
 217
 218 static int pakfire_umount(struct pakfire* pakfire, const char* path, int flags) {
 219         int r;
 220
 221         DEBUG(pakfire, "Umounting %s\n", path);
 222
 223 RETRY:
 224         // Perform umount
 225         r = umount2(path, flags);
 226         if (r) {
 227                 // Attempt a lazy umount when busy
 228                 if (errno == EBUSY) {
 229                         flags |= MNT_DETACH;
 230                         goto RETRY;
 231                 }
 232
 233                 ERROR(pakfire, "Could not umount %s: %m\n", path);
 234         }
 235
 236         return r;
 237 }
 238
 239 static int __pakfire_mount_print(struct pakfire* pakfire,
 240                 struct libmnt_fs* fs, const void* data) {
 241         DEBUG(pakfire,
 242                 "  %s %s %s %s\n",
 243                 mnt_fs_get_source(fs),
 244                 mnt_fs_get_target(fs),
 245                 mnt_fs_get_fstype(fs),
 246                 mnt_fs_get_fs_options(fs)
 247         );
 248
 249         return 0;
 250 }
 251
 252 int pakfire_mount_list(struct pakfire* pakfire) {
 253         DEBUG(pakfire, "Mountpoints:\n");
 254
 255         return pakfire_mount_foreach(pakfire, MNT_ITER_FORWARD,
 256                 __pakfire_mount_print, NULL);
 257 }
 258
 259 static int pakfire_populate_dev(struct pakfire* pakfire) {
 260         char path[PATH_MAX];
 261
 262         // Create device nodes
 263         for (const struct pakfire_devnode* devnode = devnodes; devnode->path; devnode++) {
 264                 DEBUG(pakfire, "Creating device node %s\n", devnode->path);
 265
 266                 int r = pakfire_make_path(pakfire, path, devnode->path);
 267                 if (r < 0)
 268                         return 1;
 269
 270                 dev_t dev = makedev(devnode->major, devnode->minor);
 271
 272                 r = mknod(path, devnode->mode, dev);
 273
 274                 // Continue if mknod was successful
 275                 if (r == 0)
 276                         continue;
 277
 278                 // If we could not create the device node because of permission issues,
 279                 // it might be likely that we are running in a user namespace where creating
 280                 // device nodes is not permitted. Try bind-mounting them.
 281                 if (errno == EPERM)
 282                         goto MOUNT;
 283
 284                 // Otherwise log an error and end
 285                 ERROR(pakfire, "Could not create %s: %m\n", devnode->path);
 286                 return r;
 287
 288 MOUNT:
 289                 // Create an empty file
 290                 r = pakfire_touch(path, 0444);
 291                 if (r) {
 292                         ERROR(pakfire, "Could not create %s: %m\n", path);
 293                         return r;
 294                 }
 295
 296                 // Create a bind-mount over the file
 297                 r = pakfire_mount(pakfire, path, devnode->path, "bind", MS_BIND, NULL);
 298                 if (r)
 299                         return r;
 300         }
 301
 302         // Create symlinks
 303         for (const struct pakfire_symlink* s = symlinks; s->target; s++) {
 304                 DEBUG(pakfire, "Creating symlink %s -> %s\n", s->path, s->target);
 305
 306                 int r = pakfire_make_path(pakfire, path, s->path);
 307                 if (r < 0)
 308                         return 1;
 309
 310                 r = symlink(s->target, path);
 311                 if (r) {
 312                         ERROR(pakfire, "Could not create symlink %s: %m\n", s->path);
 313                         return r;
 314                 }
 315         }
 316
 317         return 0;
 318 }
 319
 320 static int pakfire_mount_interpreter(struct pakfire* pakfire) {
 321         char target[PATH_MAX];
 322
 323         // Fetch the target architecture
 324         const char* arch = pakfire_get_arch(pakfire);
 325
 326         // Can we emulate this architecture?
 327         char* interpreter = pakfire_arch_find_interpreter(arch);
 328
 329         // No interpreter required
 330         if (!interpreter)
 331                 return 0;
 332
 333         DEBUG(pakfire, "Mounting interpreter %s for %s\n", interpreter, arch);
 334
 335         // Where to mount this?
 336         int r = pakfire_make_path(pakfire, target, interpreter);
 337         if (r < 0)
 338                 return r;
 339
 340         // Create directory
 341         r = pakfire_mkparentdir(target, 0755);
 342         if (r)
 343                 return r;
 344
 345         // Create an empty file
 346         FILE* f = fopen(target, "w");
 347         if (!f)
 348                 return 1;
 349         fclose(f);
 350
 351         r = pakfire_mount(pakfire, interpreter, target, NULL, MS_BIND|MS_RDONLY, NULL);
 352         if (r)
 353                 ERROR(pakfire, "Could not mount interpreter %s to %s: %m\n", interpreter, target);
 354
 355         return r;
 356 }
 357
 358 int pakfire_mount_all(struct pakfire* pakfire) {
 359         char target[PATH_MAX];
 360         int r;
 361
 362         // Fetch Pakfire's root directory
 363         const char* root = pakfire_get_path(pakfire);
 364
 365         for (const struct pakfire_mountpoint* mp = mountpoints; mp->source; mp++) {
 366                 // Figure out where to mount
 367                 r = pakfire_path_join(target, root, mp->target);
 368                 if (r < 0)
 369                         return r;
 370
 371                 // Create target
 372                 pakfire_mkdir(target, 0755);
 373
 374 RETRY:
 375                 // Perform mount()
 376                 r = pakfire_mount(pakfire, mp->source, target, mp->fstype, mp->flags, mp->options);
 377                 if (r) {
 378                         // If the target directory does not exist, we will create it
 379                         if (errno == ENOENT) {
 380                                 r = pakfire_mkdir(target, 0755);
 381                                 if (r) {
 382                                         ERROR(pakfire, "Could not create %s\n", target);
 383                                         return r;
 384                                 }
 385
 386                                 goto RETRY;
 387                         }
 388
 389                         return r;
 390                 }
 391         }
 392
 393         // Populate /dev
 394         r = pakfire_populate_dev(pakfire);
 395         if (r)
 396                 return r;
 397
 398         // Mount the interpreter (if needed)
 399         r = pakfire_mount_interpreter(pakfire);
 400         if (r)
 401                 return r;
 402
 403         return 0;
 404 }
 405
 406 static int __pakfire_umount(struct pakfire* pakfire,
 407                 struct libmnt_fs* fs, const void* data) {
 408         const char* target = mnt_fs_get_target(fs);
 409         if (!target)
 410                 return 1;
 411
 412         return pakfire_umount(pakfire, target, 0);
 413 }
 414
 415 /*
 416         umounts everything that hasn't been umounted, yet
 417 */
 418 int pakfire_umount_all(struct pakfire* pakfire) {
 419         return pakfire_mount_foreach(pakfire, MNT_ITER_BACKWARD,
 420                 __pakfire_umount, NULL);
 421 }
 422
 423 PAKFIRE_EXPORT int pakfire_bind(struct pakfire* pakfire, const char* src, const char* dst, int flags) {
 424         struct stat st;
 425         char mountpoint[PATH_MAX];
 426
 427         if (!dst)
 428                 dst = src;
 429
 430         int r = pakfire_make_path(pakfire, mountpoint, dst);
 431         if (r < 0)
 432                 return 1;
 433
 434         DEBUG(pakfire, "Bind-mounting %s to %s\n", src, mountpoint);
 435
 436         r = stat(src, &st);
 437         if (r < 0) {
 438                 ERROR(pakfire, "Could not stat %s: %m\n", src);
 439                 return 1;
 440         }
 441
 442         // Make sure the mountpoint exists
 443         switch (st.st_mode & S_IFMT) {
 444                 case S_IFDIR:
 445                         r = pakfire_mkdir(mountpoint, st.st_mode);
 446                         if (r && errno != EEXIST)
 447                                 return r;
 448                         break;
 449
 450                 case S_IFREG:
 451                 case S_IFLNK:
 452                         // Make parent directory
 453                         r = pakfire_mkparentdir(mountpoint, 0755);
 454                         if (r)
 455                                 return r;
 456
 457                         // Create a file
 458                         FILE* f = fopen(mountpoint, "w");
 459                         if (!f)
 460                                 return 1;
 461                         fclose(f);
 462                         break;
 463
 464                 default:
 465                         errno = ENOTSUP;
 466                         return 1;
 467         }
 468
 469         // Perform mount
 470         return pakfire_mount(pakfire, src, mountpoint, NULL, flags|MS_BIND, NULL);
 471 }