src/nspawn/nspawn-mount.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <sys/mount.h>
   4 #include <linux/magic.h>
   5
   6 #include "alloc-util.h"
   7 #include "chase.h"
   8 #include "escape.h"
   9 #include "fd-util.h"
  10 #include "format-util.h"
  11 #include "fs-util.h"
  12 #include "label-util.h"
  13 #include "mkdir-label.h"
  14 #include "mount-util.h"
  15 #include "mountpoint-util.h"
  16 #include "namespace-util.h"
  17 #include "nspawn-mount.h"
  18 #include "parse-util.h"
  19 #include "path-util.h"
  20 #include "rm-rf.h"
  21 #include "set.h"
  22 #include "sort-util.h"
  23 #include "stat-util.h"
  24 #include "string-util.h"
  25 #include "strv.h"
  26 #include "tmpfile-util.h"
  27 #include "user-util.h"
  28
  29 CustomMount* custom_mount_add(CustomMount **l, size_t *n, CustomMountType t) {
  30         CustomMount *c, *ret;
  31
  32         assert(l);
  33         assert(n);
  34         assert(t >= 0);
  35         assert(t < _CUSTOM_MOUNT_TYPE_MAX);
  36
  37         c = reallocarray(*l, *n + 1, sizeof(CustomMount));
  38         if (!c)
  39                 return NULL;
  40
  41         *l = c;
  42         ret = *l + *n;
  43         (*n)++;
  44
  45         *ret = (CustomMount) {
  46                 .type = t
  47         };
  48
  49         return ret;
  50 }
  51
  52 void custom_mount_free_all(CustomMount *l, size_t n) {
  53         for (size_t i = 0; i < n; i++) {
  54                 CustomMount *m = l + i;
  55
  56                 free(m->source);
  57                 free(m->destination);
  58                 free(m->options);
  59
  60                 if (m->work_dir) {
  61                         (void) rm_rf(m->work_dir, REMOVE_ROOT|REMOVE_PHYSICAL);
  62                         free(m->work_dir);
  63                 }
  64
  65                 if (m->rm_rf_tmpdir) {
  66                         (void) rm_rf(m->rm_rf_tmpdir, REMOVE_ROOT|REMOVE_PHYSICAL);
  67                         free(m->rm_rf_tmpdir);
  68                 }
  69
  70                 strv_free(m->lower);
  71                 free(m->type_argument);
  72         }
  73
  74         free(l);
  75 }
  76
  77 static int custom_mount_compare(const CustomMount *a, const CustomMount *b) {
  78         int r;
  79
  80         r = path_compare(a->destination, b->destination);
  81         if (r != 0)
  82                 return r;
  83
  84         return CMP(a->type, b->type);
  85 }
  86
  87 static int source_path_parse(const char *p, char **ret) {
  88         assert(p);
  89         assert(ret);
  90
  91         if (isempty(p))
  92                 return -EINVAL;
  93
  94         if (*p == '+') {
  95                 if (!path_is_absolute(p + 1))
  96                         return -EINVAL;
  97
  98                 char *s = strdup(p);
  99                 if (!s)
 100                         return -ENOMEM;
 101
 102                 *ret = TAKE_PTR(s);
 103                 return 0;
 104         }
 105
 106         return path_make_absolute_cwd(p, ret);
 107 }
 108
 109 static int source_path_parse_nullable(const char *p, char **ret) {
 110         assert(p);
 111         assert(ret);
 112
 113         if (isempty(p)) {
 114                 *ret = NULL;
 115                 return 0;
 116         }
 117
 118         return source_path_parse(p, ret);
 119 }
 120
 121 static char *resolve_source_path(const char *dest, const char *source) {
 122         if (!source)
 123                 return NULL;
 124
 125         if (source[0] == '+')
 126                 return path_join(dest, source + 1);
 127
 128         return strdup(source);
 129 }
 130
 131 static int allocate_temporary_source(CustomMount *m) {
 132         assert(m);
 133         assert(!m->source);
 134         assert(!m->rm_rf_tmpdir);
 135
 136         m->rm_rf_tmpdir = strdup("/var/tmp/nspawn-temp-XXXXXX");
 137         if (!m->rm_rf_tmpdir)
 138                 return log_oom();
 139
 140         if (!mkdtemp(m->rm_rf_tmpdir)) {
 141                 m->rm_rf_tmpdir = mfree(m->rm_rf_tmpdir);
 142                 return log_error_errno(errno, "Failed to acquire temporary directory: %m");
 143         }
 144
 145         m->source = path_join(m->rm_rf_tmpdir, "src");
 146         if (!m->source)
 147                 return log_oom();
 148
 149         if (mkdir(m->source, 0755) < 0)
 150                 return log_error_errno(errno, "Failed to create %s: %m", m->source);
 151
 152         return 0;
 153 }
 154
 155 int custom_mount_prepare_all(const char *dest, CustomMount *l, size_t n) {
 156         int r;
 157
 158         /* Prepare all custom mounts. This will make source we know all temporary directories. This is called in the
 159          * parent process, so that we know the temporary directories to remove on exit before we fork off the
 160          * children. */
 161
 162         assert(l || n == 0);
 163
 164         /* Order the custom mounts, and make sure we have a working directory */
 165         typesafe_qsort(l, n, custom_mount_compare);
 166
 167         for (size_t i = 0; i < n; i++) {
 168                 CustomMount *m = l + i;
 169
 170                 /* /proc we mount in the inner child, i.e. when we acquired CLONE_NEWPID. All other mounts we mount
 171                  * already in the outer child, so that the mounts are already established before CLONE_NEWPID and in
 172                  * particular CLONE_NEWUSER. This also means any custom mounts below /proc also need to be mounted in
 173                  * the inner child, not the outer one. Determine this here. */
 174                 m->in_userns = path_startswith(m->destination, "/proc");
 175
 176                 if (m->type == CUSTOM_MOUNT_BIND) {
 177                         if (m->source) {
 178                                 char *s;
 179
 180                                 s = resolve_source_path(dest, m->source);
 181                                 if (!s)
 182                                         return log_oom();
 183
 184                                 free_and_replace(m->source, s);
 185                         } else {
 186                                 /* No source specified? In that case, use a throw-away temporary directory in /var/tmp */
 187
 188                                 r = allocate_temporary_source(m);
 189                                 if (r < 0)
 190                                         return r;
 191                         }
 192                 }
 193
 194                 if (m->type == CUSTOM_MOUNT_OVERLAY) {
 195                         STRV_FOREACH(j, m->lower) {
 196                                 char *s;
 197
 198                                 s = resolve_source_path(dest, *j);
 199                                 if (!s)
 200                                         return log_oom();
 201
 202                                 free_and_replace(*j, s);
 203                         }
 204
 205                         if (m->source) {
 206                                 char *s;
 207
 208                                 s = resolve_source_path(dest, m->source);
 209                                 if (!s)
 210                                         return log_oom();
 211
 212                                 free_and_replace(m->source, s);
 213                         } else {
 214                                 r = allocate_temporary_source(m);
 215                                 if (r < 0)
 216                                         return r;
 217                         }
 218
 219                         if (m->work_dir) {
 220                                 char *s;
 221
 222                                 s = resolve_source_path(dest, m->work_dir);
 223                                 if (!s)
 224                                         return log_oom();
 225
 226                                 free_and_replace(m->work_dir, s);
 227                         } else {
 228                                 r = tempfn_random(m->source, NULL, &m->work_dir);
 229                                 if (r < 0)
 230                                         return log_error_errno(r, "Failed to acquire working directory: %m");
 231                         }
 232
 233                         (void) mkdir_label(m->work_dir, 0700);
 234                 }
 235         }
 236
 237         return 0;
 238 }
 239
 240 int bind_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) {
 241         _cleanup_free_ char *source = NULL, *destination = NULL, *opts = NULL, *p = NULL;
 242         CustomMount *m;
 243         int r;
 244
 245         assert(l);
 246         assert(n);
 247
 248         r = extract_many_words(&s, ":", EXTRACT_DONT_COALESCE_SEPARATORS, &source, &destination, NULL);
 249         if (r < 0)
 250                 return r;
 251         if (r == 0)
 252                 return -EINVAL;
 253         if (r == 1) {
 254                 destination = strdup(source[0] == '+' ? source+1 : source);
 255                 if (!destination)
 256                         return -ENOMEM;
 257         }
 258         if (r == 2 && !isempty(s)) {
 259                 opts = strdup(s);
 260                 if (!opts)
 261                         return -ENOMEM;
 262         }
 263
 264         r = source_path_parse_nullable(source, &p);
 265         if (r < 0)
 266                 return r;
 267
 268         if (!path_is_absolute(destination))
 269                 return -EINVAL;
 270
 271         m = custom_mount_add(l, n, CUSTOM_MOUNT_BIND);
 272         if (!m)
 273                 return -ENOMEM;
 274
 275         m->source = TAKE_PTR(p);
 276         m->destination = TAKE_PTR(destination);
 277         m->read_only = read_only;
 278         m->options = TAKE_PTR(opts);
 279
 280         return 0;
 281 }
 282
 283 int tmpfs_mount_parse(CustomMount **l, size_t *n, const char *s) {
 284         _cleanup_free_ char *path = NULL, *opts = NULL;
 285         const char *p = ASSERT_PTR(s);
 286         CustomMount *m;
 287         int r;
 288
 289         assert(l);
 290         assert(n);
 291
 292         r = extract_first_word(&p, &path, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 293         if (r < 0)
 294                 return r;
 295         if (r == 0)
 296                 return -EINVAL;
 297
 298         if (isempty(p))
 299                 opts = strdup("mode=0755");
 300         else
 301                 opts = strdup(p);
 302         if (!opts)
 303                 return -ENOMEM;
 304
 305         if (!path_is_absolute(path))
 306                 return -EINVAL;
 307
 308         m = custom_mount_add(l, n, CUSTOM_MOUNT_TMPFS);
 309         if (!m)
 310                 return -ENOMEM;
 311
 312         m->destination = TAKE_PTR(path);
 313         m->options = TAKE_PTR(opts);
 314
 315         return 0;
 316 }
 317
 318 int overlay_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) {
 319         _cleanup_free_ char *upper = NULL, *destination = NULL;
 320         _cleanup_strv_free_ char **lower = NULL;
 321         CustomMount *m;
 322         int r, k;
 323
 324         k = strv_split_full(&lower, s, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 325         if (k < 0)
 326                 return k;
 327         if (k < 2)
 328                 return -EADDRNOTAVAIL;
 329         if (k == 2) {
 330                 _cleanup_free_ char *p = NULL;
 331
 332                 /* If two parameters are specified, the first one is the lower, the second one the upper directory. And
 333                  * we'll also define the destination mount point the same as the upper. */
 334
 335                 r = source_path_parse(lower[0], &p);
 336                 if (r < 0)
 337                         return r;
 338
 339                 free_and_replace(lower[0], p);
 340
 341                 r = source_path_parse(lower[1], &p);
 342                 if (r < 0)
 343                         return r;
 344
 345                 free_and_replace(lower[1], p);
 346
 347                 upper = TAKE_PTR(lower[1]);
 348
 349                 destination = strdup(upper[0] == '+' ? upper+1 : upper); /* take the destination without "+" prefix */
 350                 if (!destination)
 351                         return -ENOMEM;
 352         } else {
 353                 _cleanup_free_ char *p = NULL;
 354
 355                 /* If more than two parameters are specified, the last one is the destination, the second to last one
 356                  * the "upper", and all before that the "lower" directories. */
 357
 358                 destination = lower[k - 1];
 359                 upper = TAKE_PTR(lower[k - 2]);
 360
 361                 STRV_FOREACH(i, lower) {
 362                         r = source_path_parse(*i, &p);
 363                         if (r < 0)
 364                                 return r;
 365
 366                         free_and_replace(*i, p);
 367                 }
 368
 369                 /* If the upper directory is unspecified, then let's create it automatically as a throw-away directory
 370                  * in /var/tmp */
 371                 r = source_path_parse_nullable(upper, &p);
 372                 if (r < 0)
 373                         return r;
 374
 375                 free_and_replace(upper, p);
 376
 377                 if (!path_is_absolute(destination))
 378                         return -EINVAL;
 379         }
 380
 381         m = custom_mount_add(l, n, CUSTOM_MOUNT_OVERLAY);
 382         if (!m)
 383                 return -ENOMEM;
 384
 385         m->destination = TAKE_PTR(destination);
 386         m->source = TAKE_PTR(upper);
 387         m->lower = TAKE_PTR(lower);
 388         m->read_only = read_only;
 389
 390         return 0;
 391 }
 392
 393 int inaccessible_mount_parse(CustomMount **l, size_t *n, const char *s) {
 394         _cleanup_free_ char *path = NULL;
 395         CustomMount *m;
 396
 397         assert(l);
 398         assert(n);
 399         assert(s);
 400
 401         if (!path_is_absolute(s))
 402                 return -EINVAL;
 403
 404         path = strdup(s);
 405         if (!path)
 406                 return -ENOMEM;
 407
 408         m = custom_mount_add(l, n, CUSTOM_MOUNT_INACCESSIBLE);
 409         if (!m)
 410                 return -ENOMEM;
 411
 412         m->destination = TAKE_PTR(path);
 413         return 0;
 414 }
 415
 416 int tmpfs_patch_options(
 417                 const char *options,
 418                 uid_t uid_shift,
 419                 const char *selinux_apifs_context,
 420                 char **ret) {
 421
 422         _cleanup_free_ char *buf = NULL;
 423
 424         assert(ret);
 425
 426         if (options) {
 427                 buf = strdup(options);
 428                 if (!buf)
 429                         return -ENOMEM;
 430         }
 431
 432         if (uid_shift != UID_INVALID)
 433                 if (strextendf_with_separator(&buf, ",", "uid=" UID_FMT ",gid=" UID_FMT, uid_shift, uid_shift) < 0)
 434                         return -ENOMEM;
 435
 436 #if HAVE_SELINUX
 437         if (selinux_apifs_context)
 438                 if (strextendf_with_separator(&buf, ",", "context=\"%s\"", selinux_apifs_context) < 0)
 439                         return -ENOMEM;
 440 #endif
 441
 442         *ret = TAKE_PTR(buf);
 443         return !!*ret;
 444 }
 445
 446 int mount_sysfs(const char *dest, MountSettingsMask mount_settings) {
 447         const char *full, *top;
 448         int r;
 449         unsigned long extra_flags = 0;
 450
 451         top = prefix_roota(dest, "/sys");
 452         r = path_is_fs_type(top, SYSFS_MAGIC);
 453         if (r < 0)
 454                 return log_error_errno(r, "Failed to determine filesystem type of %s: %m", top);
 455         /* /sys might already be mounted as sysfs by the outer child in the
 456          * !netns case. In this case, it's all good. Don't touch it because we
 457          * don't have the right to do so, see https://github.com/systemd/systemd/issues/1555.
 458          */
 459         if (r > 0)
 460                 return 0;
 461
 462         full = prefix_roota(top, "/full");
 463
 464         (void) mkdir(full, 0755);
 465
 466         if (FLAGS_SET(mount_settings, MOUNT_APPLY_APIVFS_RO))
 467                 extra_flags |= MS_RDONLY;
 468
 469         r = mount_nofollow_verbose(LOG_ERR, "sysfs", full, "sysfs",
 470                                    MS_NOSUID|MS_NOEXEC|MS_NODEV|extra_flags, NULL);
 471         if (r < 0)
 472                 return r;
 473
 474         FOREACH_STRING(x, "block", "bus", "class", "dev", "devices", "kernel") {
 475                 _cleanup_free_ char *from = NULL, *to = NULL;
 476
 477                 from = path_join(full, x);
 478                 if (!from)
 479                         return log_oom();
 480
 481                 to = path_join(top, x);
 482                 if (!to)
 483                         return log_oom();
 484
 485                 (void) mkdir(to, 0755);
 486
 487                 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
 488                 if (r < 0)
 489                         return r;
 490
 491                 r = mount_nofollow_verbose(LOG_ERR, NULL, to, NULL,
 492                                            MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT|extra_flags, NULL);
 493                 if (r < 0)
 494                         return r;
 495         }
 496
 497         r = umount_verbose(LOG_ERR, full, UMOUNT_NOFOLLOW);
 498         if (r < 0)
 499                 return r;
 500
 501         if (rmdir(full) < 0)
 502                 return log_error_errno(errno, "Failed to remove %s: %m", full);
 503
 504         /* Create mountpoint for cgroups. Otherwise we are not allowed since we
 505          * remount /sys read-only.
 506          */
 507         const char *x = prefix_roota(top, "/fs/cgroup");
 508         (void) mkdir_p(x, 0755);
 509
 510         return mount_nofollow_verbose(LOG_ERR, NULL, top, NULL,
 511                                       MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT|extra_flags, NULL);
 512 }
 513
 514 #define PROC_DEFAULT_MOUNT_FLAGS (MS_NOSUID|MS_NOEXEC|MS_NODEV)
 515 #define SYS_DEFAULT_MOUNT_FLAGS  (MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV)
 516
 517 int mount_all(const char *dest,
 518               MountSettingsMask mount_settings,
 519               uid_t uid_shift,
 520               const char *selinux_apifs_context) {
 521
 522 #define PROC_INACCESSIBLE_REG(path)                                     \
 523         { "/run/systemd/inaccessible/reg", (path), NULL, NULL, MS_BIND, \
 524           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
 525         { NULL, (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
 526           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
 527
 528 #define PROC_READ_ONLY(path)                                            \
 529         { (path), (path), NULL, NULL, MS_BIND,                          \
 530           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
 531         { NULL,   (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
 532           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
 533
 534         typedef struct MountPoint {
 535                 const char *what;
 536                 const char *where;
 537                 const char *type;
 538                 const char *options;
 539                 unsigned long flags;
 540                 MountSettingsMask mount_settings;
 541         } MountPoint;
 542
 543         static const MountPoint mount_table[] = {
 544                 /* First we list inner child mounts (i.e. mounts applied *after* entering user namespacing) */
 545                 { "proc",            "/proc",           "proc",  NULL,        PROC_DEFAULT_MOUNT_FLAGS,
 546                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_MKDIR|MOUNT_FOLLOW_SYMLINKS }, /* we follow symlinks here since not following them requires /proc/ already being mounted, which we don't have here. */
 547
 548                 { "/proc/sys",       "/proc/sys",       NULL,    NULL,        MS_BIND,
 549                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO },                          /* Bind mount first ... */
 550
 551                 { "/proc/sys/net",   "/proc/sys/net",   NULL,    NULL,        MS_BIND,
 552                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS }, /* (except for this) */
 553
 554                 { NULL,              "/proc/sys",       NULL,    NULL,        MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 555                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO },                          /* ... then, make it r/o */
 556
 557                 /* Make these files inaccessible to container payloads: they potentially leak information about kernel
 558                  * internals or the host's execution environment to the container */
 559                 PROC_INACCESSIBLE_REG("/proc/kallsyms"),
 560                 PROC_INACCESSIBLE_REG("/proc/kcore"),
 561                 PROC_INACCESSIBLE_REG("/proc/keys"),
 562                 PROC_INACCESSIBLE_REG("/proc/sysrq-trigger"),
 563                 PROC_INACCESSIBLE_REG("/proc/timer_list"),
 564
 565                 /* Make these directories read-only to container payloads: they show hardware information, and in some
 566                  * cases contain tunables the container really shouldn't have access to. */
 567                 PROC_READ_ONLY("/proc/acpi"),
 568                 PROC_READ_ONLY("/proc/apm"),
 569                 PROC_READ_ONLY("/proc/asound"),
 570                 PROC_READ_ONLY("/proc/bus"),
 571                 PROC_READ_ONLY("/proc/fs"),
 572                 PROC_READ_ONLY("/proc/irq"),
 573                 PROC_READ_ONLY("/proc/scsi"),
 574
 575                 { "mqueue",                 "/dev/mqueue",                  "mqueue", NULL,                            MS_NOSUID|MS_NOEXEC|MS_NODEV,
 576                   MOUNT_IN_USERNS|MOUNT_MKDIR },
 577
 578                 /* Then we list outer child mounts (i.e. mounts applied *before* entering user namespacing) */
 579                 { "tmpfs",                  "/tmp",                         "tmpfs", "mode=01777" NESTED_TMPFS_LIMITS, MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 580                   MOUNT_FATAL|MOUNT_APPLY_TMPFS_TMP|MOUNT_MKDIR },
 581                 { "tmpfs",                  "/sys",                         "tmpfs", "mode=0555" TMPFS_LIMITS_SYS,     MS_NOSUID|MS_NOEXEC|MS_NODEV,
 582                   MOUNT_FATAL|MOUNT_APPLY_APIVFS_NETNS|MOUNT_MKDIR },
 583                 { "sysfs",                  "/sys",                         "sysfs", NULL,                             SYS_DEFAULT_MOUNT_FLAGS,
 584                   MOUNT_FATAL|MOUNT_APPLY_APIVFS_RO|MOUNT_MKDIR },    /* skipped if above was mounted */
 585                 { "sysfs",                  "/sys",                         "sysfs", NULL,                             MS_NOSUID|MS_NOEXEC|MS_NODEV,
 586                   MOUNT_FATAL|MOUNT_MKDIR },                          /* skipped if above was mounted */
 587                 { "tmpfs",                  "/dev",                         "tmpfs", "mode=0755" TMPFS_LIMITS_PRIVATE_DEV, MS_NOSUID|MS_STRICTATIME,
 588                   MOUNT_FATAL|MOUNT_MKDIR },
 589                 { "tmpfs",                  "/dev/shm",                     "tmpfs", "mode=01777" NESTED_TMPFS_LIMITS, MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 590                   MOUNT_FATAL|MOUNT_MKDIR },
 591                 { "tmpfs",                  "/run",                         "tmpfs", "mode=0755" TMPFS_LIMITS_RUN,     MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 592                   MOUNT_FATAL|MOUNT_MKDIR },
 593                 { "/run/host",              "/run/host",                    NULL,    NULL,                             MS_BIND,
 594                   MOUNT_FATAL|MOUNT_MKDIR|MOUNT_PREFIX_ROOT }, /* Prepare this so that we can make it read-only when we are done */
 595                 { "/etc/os-release",        "/run/host/os-release",         NULL,    NULL,                             MS_BIND,
 596                   MOUNT_TOUCH }, /* As per kernel interface requirements, bind mount first (creating mount points) and make read-only later */
 597                 { "/usr/lib/os-release",    "/run/host/os-release",         NULL,    NULL,                             MS_BIND,
 598                   MOUNT_FATAL }, /* If /etc/os-release doesn't exist use the version in /usr/lib as fallback */
 599                 { NULL,                     "/run/host/os-release",         NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 600                   MOUNT_FATAL },
 601                 { NULL,                     "/run/host/os-release",         NULL,    NULL,                             MS_PRIVATE,
 602                   MOUNT_FATAL },  /* Turn off propagation (we only want that for the mount propagation tunnel dir) */
 603                 { NULL,                     "/run/host",                    NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 604                   MOUNT_FATAL|MOUNT_IN_USERNS },
 605 #if HAVE_SELINUX
 606                 { "/sys/fs/selinux",        "/sys/fs/selinux",              NULL,    NULL,                             MS_BIND,
 607                   MOUNT_MKDIR },  /* Bind mount first (mkdir/chown the mount point in case /sys/ is mounted as minimal skeleton tmpfs) */
 608                 { NULL,                     "/sys/fs/selinux",              NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 609                   0 },            /* Then, make it r/o (don't mkdir/chown the mount point here, the previous entry already did that) */
 610                 { NULL,                     "/sys/fs/selinux",              NULL,    NULL,                             MS_PRIVATE,
 611                   0 },            /* Turn off propagation (we only want that for the mount propagation tunnel dir) */
 612 #endif
 613         };
 614
 615         bool use_userns = FLAGS_SET(mount_settings, MOUNT_USE_USERNS);
 616         bool netns = FLAGS_SET(mount_settings, MOUNT_APPLY_APIVFS_NETNS);
 617         bool ro = FLAGS_SET(mount_settings, MOUNT_APPLY_APIVFS_RO);
 618         bool in_userns = FLAGS_SET(mount_settings, MOUNT_IN_USERNS);
 619         bool tmpfs_tmp = FLAGS_SET(mount_settings, MOUNT_APPLY_TMPFS_TMP);
 620         int r;
 621
 622         for (size_t k = 0; k < ELEMENTSOF(mount_table); k++) {
 623                 _cleanup_free_ char *where = NULL, *options = NULL, *prefixed = NULL;
 624                 bool fatal = FLAGS_SET(mount_table[k].mount_settings, MOUNT_FATAL);
 625                 const char *o;
 626
 627                 if (in_userns != FLAGS_SET(mount_table[k].mount_settings, MOUNT_IN_USERNS))
 628                         continue;
 629
 630                 if (!netns && FLAGS_SET(mount_table[k].mount_settings, MOUNT_APPLY_APIVFS_NETNS))
 631                         continue;
 632
 633                 if (!ro && FLAGS_SET(mount_table[k].mount_settings, MOUNT_APPLY_APIVFS_RO))
 634                         continue;
 635
 636                 if (!tmpfs_tmp && FLAGS_SET(mount_table[k].mount_settings, MOUNT_APPLY_TMPFS_TMP))
 637                         continue;
 638
 639                 r = chase(mount_table[k].where, dest, CHASE_NONEXISTENT|CHASE_PREFIX_ROOT, &where, NULL);
 640                 if (r < 0)
 641                         return log_error_errno(r, "Failed to resolve %s%s: %m", strempty(dest), mount_table[k].where);
 642
 643                 /* Skip this entry if it is not a remount. */
 644                 if (mount_table[k].what) {
 645                         r = path_is_mount_point(where, NULL, 0);
 646                         if (r < 0 && r != -ENOENT)
 647                                 return log_error_errno(r, "Failed to detect whether %s is a mount point: %m", where);
 648                         if (r > 0)
 649                                 continue;
 650                 }
 651
 652                 if ((mount_table[k].mount_settings & (MOUNT_MKDIR|MOUNT_TOUCH)) != 0) {
 653                         uid_t u = (use_userns && !in_userns) ? uid_shift : UID_INVALID;
 654
 655                         if (FLAGS_SET(mount_table[k].mount_settings, MOUNT_TOUCH))
 656                                 r = mkdir_parents_safe(dest, where, 0755, u, u, 0);
 657                         else
 658                                 r = mkdir_p_safe(dest, where, 0755, u, u, 0);
 659                         if (r < 0 && r != -EEXIST) {
 660                                 if (fatal && r != -EROFS)
 661                                         return log_error_errno(r, "Failed to create directory %s: %m", where);
 662
 663                                 log_debug_errno(r, "Failed to create directory %s: %m", where);
 664
 665                                 /* If we failed mkdir() or chown() due to the root directory being read only,
 666                                  * attempt to mount this fs anyway and let mount_verbose log any errors */
 667                                 if (r != -EROFS)
 668                                         continue;
 669                         }
 670                 }
 671
 672                 if (FLAGS_SET(mount_table[k].mount_settings, MOUNT_TOUCH)) {
 673                         r = touch(where);
 674                         if (r < 0 && r != -EEXIST) {
 675                                 if (fatal && r != -EROFS)
 676                                         return log_error_errno(r, "Failed to create file %s: %m", where);
 677
 678                                 log_debug_errno(r, "Failed to create file %s: %m", where);
 679                                 if (r != -EROFS)
 680                                         continue;
 681                         }
 682                 }
 683
 684                 o = mount_table[k].options;
 685                 if (streq_ptr(mount_table[k].type, "tmpfs")) {
 686                         r = tmpfs_patch_options(o, in_userns ? 0 : uid_shift, selinux_apifs_context, &options);
 687                         if (r < 0)
 688                                 return log_oom();
 689                         if (r > 0)
 690                                 o = options;
 691                 }
 692
 693                 if (FLAGS_SET(mount_table[k].mount_settings, MOUNT_PREFIX_ROOT)) {
 694                         /* Optionally prefix the mount source with the root dir. This is useful in bind
 695                          * mounts to be created within the container image before we transition into it. Note
 696                          * that MOUNT_IN_USERNS is run after we transitioned hence prefixing is not ncessary
 697                          * for those. */
 698                         r = chase(mount_table[k].what, dest, CHASE_PREFIX_ROOT, &prefixed, NULL);
 699                         if (r < 0)
 700                                 return log_error_errno(r, "Failed to resolve %s%s: %m", strempty(dest), mount_table[k].what);
 701                 }
 702
 703                 r = mount_verbose_full(
 704                                 fatal ? LOG_ERR : LOG_DEBUG,
 705                                 prefixed ?: mount_table[k].what,
 706                                 where,
 707                                 mount_table[k].type,
 708                                 mount_table[k].flags,
 709                                 o,
 710                                 FLAGS_SET(mount_table[k].mount_settings, MOUNT_FOLLOW_SYMLINKS));
 711                 if (r < 0 && fatal)
 712                         return r;
 713         }
 714
 715         return 0;
 716 }
 717
 718 static int parse_mount_bind_options(const char *options, unsigned long *mount_flags, char **mount_opts, RemountIdmapping *idmapping) {
 719         unsigned long flags = *mount_flags;
 720         char *opts = NULL;
 721         RemountIdmapping new_idmapping = *idmapping;
 722         int r;
 723
 724         assert(options);
 725
 726         for (;;) {
 727                 _cleanup_free_ char *word = NULL;
 728
 729                 r = extract_first_word(&options, &word, ",", 0);
 730                 if (r < 0)
 731                         return log_error_errno(r, "Failed to extract mount option: %m");
 732                 if (r == 0)
 733                         break;
 734
 735                 if (streq(word, "rbind"))
 736                         flags |= MS_REC;
 737                 else if (streq(word, "norbind"))
 738                         flags &= ~MS_REC;
 739                 else if (streq(word, "idmap"))
 740                         new_idmapping = REMOUNT_IDMAPPING_HOST_ROOT;
 741                 else if (streq(word, "noidmap"))
 742                         new_idmapping = REMOUNT_IDMAPPING_NONE;
 743                 else if (streq(word, "rootidmap"))
 744                         new_idmapping = REMOUNT_IDMAPPING_HOST_OWNER;
 745                 else
 746                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 747                                                "Invalid bind mount option: %s", word);
 748         }
 749
 750         *mount_flags = flags;
 751         *idmapping = new_idmapping;
 752         /* in the future mount_opts will hold string options for mount(2) */
 753         *mount_opts = opts;
 754
 755         return 0;
 756 }
 757
 758 static int mount_bind(const char *dest, CustomMount *m, uid_t uid_shift, uid_t uid_range) {
 759         _cleanup_free_ char *mount_opts = NULL, *where = NULL;
 760         unsigned long mount_flags = MS_BIND | MS_REC;
 761         struct stat source_st, dest_st;
 762         int r;
 763         RemountIdmapping idmapping = REMOUNT_IDMAPPING_NONE;
 764
 765         assert(dest);
 766         assert(m);
 767
 768         if (m->options) {
 769                 r = parse_mount_bind_options(m->options, &mount_flags, &mount_opts, &idmapping);
 770                 if (r < 0)
 771                         return r;
 772         }
 773
 774         /* If this is a bind mount from a temporary sources change ownership of the source to the container's
 775          * root UID. Otherwise it would always show up as "nobody" if user namespacing is used. */
 776         if (m->rm_rf_tmpdir && chown(m->source, uid_shift, uid_shift) < 0)
 777                 return log_error_errno(errno, "Failed to chown %s: %m", m->source);
 778
 779         if (stat(m->source, &source_st) < 0)
 780                 return log_error_errno(errno, "Failed to stat %s: %m", m->source);
 781
 782         r = chase(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where, NULL);
 783         if (r < 0)
 784                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 785         if (r > 0) { /* Path exists already? */
 786
 787                 if (stat(where, &dest_st) < 0)
 788                         return log_error_errno(errno, "Failed to stat %s: %m", where);
 789
 790                 if (S_ISDIR(source_st.st_mode) && !S_ISDIR(dest_st.st_mode))
 791                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 792                                                "Cannot bind mount directory %s on file %s.",
 793                                                m->source, where);
 794
 795                 if (!S_ISDIR(source_st.st_mode) && S_ISDIR(dest_st.st_mode))
 796                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 797                                                "Cannot bind mount file %s on directory %s.",
 798                                                m->source, where);
 799
 800         } else { /* Path doesn't exist yet? */
 801                 r = mkdir_parents_safe_label(dest, where, 0755, uid_shift, uid_shift, MKDIR_IGNORE_EXISTING);
 802                 if (r < 0)
 803                         return log_error_errno(r, "Failed to make parents of %s: %m", where);
 804
 805                 /* Create the mount point. Any non-directory file can be
 806                 * mounted on any non-directory file (regular, fifo, socket,
 807                 * char, block).
 808                 */
 809                 if (S_ISDIR(source_st.st_mode))
 810                         r = mkdir_label(where, 0755);
 811                 else
 812                         r = touch(where);
 813                 if (r < 0)
 814                         return log_error_errno(r, "Failed to create mount point %s: %m", where);
 815
 816                 if (chown(where, uid_shift, uid_shift) < 0)
 817                         return log_error_errno(errno, "Failed to chown %s: %m", where);
 818         }
 819
 820         r = mount_nofollow_verbose(LOG_ERR, m->source, where, NULL, mount_flags, mount_opts);
 821         if (r < 0)
 822                 return r;
 823
 824         if (m->read_only) {
 825                 r = bind_remount_recursive(where, MS_RDONLY, MS_RDONLY, NULL);
 826                 if (r < 0)
 827                         return log_error_errno(r, "Read-only bind mount failed: %m");
 828         }
 829
 830         if (idmapping != REMOUNT_IDMAPPING_NONE) {
 831                 r = remount_idmap(where, uid_shift, uid_range, source_st.st_uid, idmapping);
 832                 if (r < 0)
 833                         return log_error_errno(r, "Failed to map ids for bind mount %s: %m", where);
 834         }
 835
 836         return 0;
 837 }
 838
 839 static int mount_tmpfs(const char *dest, CustomMount *m, uid_t uid_shift, const char *selinux_apifs_context) {
 840         const char *options;
 841         _cleanup_free_ char *buf = NULL, *where = NULL;
 842         int r;
 843
 844         assert(dest);
 845         assert(m);
 846
 847         r = chase(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where, NULL);
 848         if (r < 0)
 849                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 850         if (r == 0) { /* Doesn't exist yet? */
 851                 r = mkdir_p_label(where, 0755);
 852                 if (r < 0)
 853                         return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
 854         }
 855
 856         r = tmpfs_patch_options(m->options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
 857         if (r < 0)
 858                 return log_oom();
 859         options = r > 0 ? buf : m->options;
 860
 861         return mount_nofollow_verbose(LOG_ERR, "tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, options);
 862 }
 863
 864 static char *joined_and_escaped_lower_dirs(char **lower) {
 865         _cleanup_strv_free_ char **sv = NULL;
 866
 867         sv = strv_copy(lower);
 868         if (!sv)
 869                 return NULL;
 870
 871         strv_reverse(sv);
 872
 873         if (!strv_shell_escape(sv, ",:"))
 874                 return NULL;
 875
 876         return strv_join(sv, ":");
 877 }
 878
 879 static int mount_overlay(const char *dest, CustomMount *m) {
 880         _cleanup_free_ char *lower = NULL, *where = NULL, *escaped_source = NULL;
 881         const char *options;
 882         int r;
 883
 884         assert(dest);
 885         assert(m);
 886
 887         r = chase(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where, NULL);
 888         if (r < 0)
 889                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 890         if (r == 0) { /* Doesn't exist yet? */
 891                 r = mkdir_label(where, 0755);
 892                 if (r < 0)
 893                         return log_error_errno(r, "Creating mount point for overlay %s failed: %m", where);
 894         }
 895
 896         (void) mkdir_p_label(m->source, 0755);
 897
 898         lower = joined_and_escaped_lower_dirs(m->lower);
 899         if (!lower)
 900                 return log_oom();
 901
 902         escaped_source = shell_escape(m->source, ",:");
 903         if (!escaped_source)
 904                 return log_oom();
 905
 906         if (m->read_only)
 907                 options = strjoina("lowerdir=", escaped_source, ":", lower);
 908         else {
 909                 _cleanup_free_ char *escaped_work_dir = NULL;
 910
 911                 escaped_work_dir = shell_escape(m->work_dir, ",:");
 912                 if (!escaped_work_dir)
 913                         return log_oom();
 914
 915                 options = strjoina("lowerdir=", lower, ",upperdir=", escaped_source, ",workdir=", escaped_work_dir);
 916         }
 917
 918         return mount_nofollow_verbose(LOG_ERR, "overlay", where, "overlay", m->read_only ? MS_RDONLY : 0, options);
 919 }
 920
 921 static int mount_inaccessible(const char *dest, CustomMount *m) {
 922         _cleanup_free_ char *where = NULL, *source = NULL;
 923         struct stat st;
 924         int r;
 925
 926         assert(dest);
 927         assert(m);
 928
 929         r = chase_and_stat(m->destination, dest, CHASE_PREFIX_ROOT, &where, &st);
 930         if (r < 0) {
 931                 log_full_errno(m->graceful ? LOG_DEBUG : LOG_ERR, r, "Failed to resolve %s/%s: %m", dest, m->destination);
 932                 return m->graceful ? 0 : r;
 933         }
 934
 935         r = mode_to_inaccessible_node(NULL, st.st_mode, &source);
 936         if (r < 0)
 937                 return m->graceful ? 0 : r;
 938
 939         r = mount_nofollow_verbose(m->graceful ? LOG_DEBUG : LOG_ERR, source, where, NULL, MS_BIND, NULL);
 940         if (r < 0)
 941                 return m->graceful ? 0 : r;
 942
 943         r = mount_nofollow_verbose(m->graceful ? LOG_DEBUG : LOG_ERR, NULL, where, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, NULL);
 944         if (r < 0) {
 945                 (void) umount_verbose(m->graceful ? LOG_DEBUG : LOG_ERR, where, UMOUNT_NOFOLLOW);
 946                 return m->graceful ? 0 : r;
 947         }
 948
 949         return 0;
 950 }
 951
 952 static int mount_arbitrary(const char *dest, CustomMount *m) {
 953         _cleanup_free_ char *where = NULL;
 954         int r;
 955
 956         assert(dest);
 957         assert(m);
 958
 959         r = chase(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where, NULL);
 960         if (r < 0)
 961                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 962         if (r == 0) { /* Doesn't exist yet? */
 963                 r = mkdir_p_label(where, 0755);
 964                 if (r < 0)
 965                         return log_error_errno(r, "Creating mount point for mount %s failed: %m", where);
 966         }
 967
 968         return mount_nofollow_verbose(LOG_ERR, m->source, where, m->type_argument, 0, m->options);
 969 }
 970
 971 int mount_custom(
 972                 const char *dest,
 973                 CustomMount *mounts, size_t n,
 974                 uid_t uid_shift,
 975                 uid_t uid_range,
 976                 const char *selinux_apifs_context,
 977                 MountSettingsMask mount_settings) {
 978         int r;
 979
 980         assert(dest);
 981
 982         for (size_t i = 0; i < n; i++) {
 983                 CustomMount *m = mounts + i;
 984
 985                 if (FLAGS_SET(mount_settings, MOUNT_IN_USERNS) != m->in_userns)
 986                         continue;
 987
 988                 if (FLAGS_SET(mount_settings, MOUNT_ROOT_ONLY) && !path_equal(m->destination, "/"))
 989                         continue;
 990
 991                 if (FLAGS_SET(mount_settings, MOUNT_NON_ROOT_ONLY) && path_equal(m->destination, "/"))
 992                         continue;
 993
 994                 switch (m->type) {
 995
 996                 case CUSTOM_MOUNT_BIND:
 997                         r = mount_bind(dest, m, uid_shift, uid_range);
 998                         break;
 999
1000                 case CUSTOM_MOUNT_TMPFS:
1001                         r = mount_tmpfs(dest, m, uid_shift, selinux_apifs_context);
1002                         break;
1003
1004                 case CUSTOM_MOUNT_OVERLAY:
1005                         r = mount_overlay(dest, m);
1006                         break;
1007
1008                 case CUSTOM_MOUNT_INACCESSIBLE:
1009                         r = mount_inaccessible(dest, m);
1010                         break;
1011
1012                 case CUSTOM_MOUNT_ARBITRARY:
1013                         r = mount_arbitrary(dest, m);
1014                         break;
1015
1016                 default:
1017                         assert_not_reached();
1018                 }
1019
1020                 if (r < 0)
1021                         return r;
1022         }
1023
1024         return 0;
1025 }
1026
1027 bool has_custom_root_mount(const CustomMount *mounts, size_t n) {
1028         for (size_t i = 0; i < n; i++)
1029                 if (path_equal(mounts[i].destination, "/"))
1030                         return true;
1031
1032         return false;
1033 }
1034
1035 static int setup_volatile_state(const char *directory, uid_t uid_shift, const char *selinux_apifs_context) {
1036         _cleanup_free_ char *buf = NULL;
1037         const char *p, *options;
1038         int r;
1039
1040         assert(directory);
1041
1042         /* --volatile=state means we simply overmount /var with a tmpfs, and the rest read-only. */
1043
1044         r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
1045         if (r < 0)
1046                 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
1047
1048         p = prefix_roota(directory, "/var");
1049         r = mkdir(p, 0755);
1050         if (r < 0 && errno != EEXIST)
1051                 return log_error_errno(errno, "Failed to create %s: %m", directory);
1052
1053         options = "mode=0755" TMPFS_LIMITS_VOLATILE_STATE;
1054         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
1055         if (r < 0)
1056                 return log_oom();
1057         if (r > 0)
1058                 options = buf;
1059
1060         return mount_nofollow_verbose(LOG_ERR, "tmpfs", p, "tmpfs", MS_STRICTATIME, options);
1061 }
1062
1063 static int setup_volatile_yes(const char *directory, uid_t uid_shift, const char *selinux_apifs_context) {
1064         bool tmpfs_mounted = false, bind_mounted = false;
1065         char template[] = "/tmp/nspawn-volatile-XXXXXX";
1066         _cleanup_free_ char *buf = NULL, *bindir = NULL;
1067         const char *f, *t, *options;
1068         struct stat st;
1069         int r;
1070
1071         assert(directory);
1072
1073         /* --volatile=yes means we mount a tmpfs to the root dir, and the original /usr to use inside it, and
1074          * that read-only. Before we start setting this up let's validate if the image has the /usr merge
1075          * implemented, and let's output a friendly log message if it hasn't. */
1076
1077         bindir = path_join(directory, "/bin");
1078         if (!bindir)
1079                 return log_oom();
1080         if (lstat(bindir, &st) < 0) {
1081                 if (errno != ENOENT)
1082                         return log_error_errno(errno, "Failed to stat /bin directory below image: %m");
1083
1084                 /* ENOENT is fine, just means the image is probably just a naked /usr and we can create the
1085                  * rest. */
1086         } else if (S_ISDIR(st.st_mode))
1087                 return log_error_errno(SYNTHETIC_ERRNO(EISDIR),
1088                                        "Sorry, --volatile=yes mode is not supported with OS images that have not merged /bin/, /sbin/, /lib/, /lib64/ into /usr/. "
1089                                        "Please work with your distribution and help them adopt the merged /usr scheme.");
1090         else if (!S_ISLNK(st.st_mode))
1091                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1092                                        "Error starting image: if --volatile=yes is used /bin must be a symlink (for merged /usr support) or non-existent (in which case a symlink is created automatically).");
1093
1094         if (!mkdtemp(template))
1095                 return log_error_errno(errno, "Failed to create temporary directory: %m");
1096
1097         options = "mode=0755" TMPFS_LIMITS_ROOTFS;
1098         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
1099         if (r < 0)
1100                 goto fail;
1101         if (r > 0)
1102                 options = buf;
1103
1104         r = mount_nofollow_verbose(LOG_ERR, "tmpfs", template, "tmpfs", MS_STRICTATIME, options);
1105         if (r < 0)
1106                 goto fail;
1107
1108         tmpfs_mounted = true;
1109
1110         f = prefix_roota(directory, "/usr");
1111         t = prefix_roota(template, "/usr");
1112
1113         r = mkdir(t, 0755);
1114         if (r < 0 && errno != EEXIST) {
1115                 r = log_error_errno(errno, "Failed to create %s: %m", t);
1116                 goto fail;
1117         }
1118
1119         r = mount_nofollow_verbose(LOG_ERR, f, t, NULL, MS_BIND|MS_REC, NULL);
1120         if (r < 0)
1121                 goto fail;
1122
1123         bind_mounted = true;
1124
1125         r = bind_remount_recursive(t, MS_RDONLY, MS_RDONLY, NULL);
1126         if (r < 0) {
1127                 log_error_errno(r, "Failed to remount %s read-only: %m", t);
1128                 goto fail;
1129         }
1130
1131         r = mount_nofollow_verbose(LOG_ERR, template, directory, NULL, MS_MOVE, NULL);
1132         if (r < 0)
1133                 goto fail;
1134
1135         (void) rmdir(template);
1136
1137         return 0;
1138
1139 fail:
1140         if (bind_mounted)
1141                 (void) umount_verbose(LOG_ERR, t, UMOUNT_NOFOLLOW);
1142
1143         if (tmpfs_mounted)
1144                 (void) umount_verbose(LOG_ERR, template, UMOUNT_NOFOLLOW);
1145
1146         (void) rmdir(template);
1147         return r;
1148 }
1149
1150 static int setup_volatile_overlay(const char *directory, uid_t uid_shift, const char *selinux_apifs_context) {
1151         _cleanup_free_ char *buf = NULL, *escaped_directory = NULL, *escaped_upper = NULL, *escaped_work = NULL;
1152         char template[] = "/tmp/nspawn-volatile-XXXXXX";
1153         const char *upper, *work, *options;
1154         bool tmpfs_mounted = false;
1155         int r;
1156
1157         assert(directory);
1158
1159         /* --volatile=overlay means we mount an overlayfs to the root dir. */
1160
1161         if (!mkdtemp(template))
1162                 return log_error_errno(errno, "Failed to create temporary directory: %m");
1163
1164         options = "mode=0755" TMPFS_LIMITS_ROOTFS;
1165         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
1166         if (r < 0)
1167                 goto finish;
1168         if (r > 0)
1169                 options = buf;
1170
1171         r = mount_nofollow_verbose(LOG_ERR, "tmpfs", template, "tmpfs", MS_STRICTATIME, options);
1172         if (r < 0)
1173                 goto finish;
1174
1175         tmpfs_mounted = true;
1176
1177         upper = strjoina(template, "/upper");
1178         work = strjoina(template, "/work");
1179
1180         if (mkdir(upper, 0755) < 0) {
1181                 r = log_error_errno(errno, "Failed to create %s: %m", upper);
1182                 goto finish;
1183         }
1184         if (mkdir(work, 0755) < 0) {
1185                 r = log_error_errno(errno, "Failed to create %s: %m", work);
1186                 goto finish;
1187         }
1188
1189         /* And now, let's overmount the root dir with an overlayfs that uses the root dir as lower dir. It's kinda nice
1190          * that the kernel allows us to do that without going through some mount point rearrangements. */
1191
1192         escaped_directory = shell_escape(directory, ",:");
1193         escaped_upper = shell_escape(upper, ",:");
1194         escaped_work = shell_escape(work, ",:");
1195         if (!escaped_directory || !escaped_upper || !escaped_work) {
1196                 r = -ENOMEM;
1197                 goto finish;
1198         }
1199
1200         options = strjoina("lowerdir=", escaped_directory, ",upperdir=", escaped_upper, ",workdir=", escaped_work);
1201         r = mount_nofollow_verbose(LOG_ERR, "overlay", directory, "overlay", 0, options);
1202
1203 finish:
1204         if (tmpfs_mounted)
1205                 (void) umount_verbose(LOG_ERR, template, UMOUNT_NOFOLLOW);
1206
1207         (void) rmdir(template);
1208         return r;
1209 }
1210
1211 int setup_volatile_mode(
1212                 const char *directory,
1213                 VolatileMode mode,
1214                 uid_t uid_shift,
1215                 const char *selinux_apifs_context) {
1216
1217         switch (mode) {
1218
1219         case VOLATILE_YES:
1220                 return setup_volatile_yes(directory, uid_shift, selinux_apifs_context);
1221
1222         case VOLATILE_STATE:
1223                 return setup_volatile_state(directory, uid_shift, selinux_apifs_context);
1224
1225         case VOLATILE_OVERLAY:
1226                 return setup_volatile_overlay(directory, uid_shift, selinux_apifs_context);
1227
1228         default:
1229                 return 0;
1230         }
1231 }
1232
1233 /* Expects *pivot_root_new and *pivot_root_old to be initialised to allocated memory or NULL. */
1234 int pivot_root_parse(char **pivot_root_new, char **pivot_root_old, const char *s) {
1235         _cleanup_free_ char *root_new = NULL, *root_old = NULL;
1236         const char *p = s;
1237         int r;
1238
1239         assert(pivot_root_new);
1240         assert(pivot_root_old);
1241
1242         r = extract_first_word(&p, &root_new, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1243         if (r < 0)
1244                 return r;
1245         if (r == 0)
1246                 return -EINVAL;
1247
1248         if (isempty(p))
1249                 root_old = NULL;
1250         else {
1251                 root_old = strdup(p);
1252                 if (!root_old)
1253                         return -ENOMEM;
1254         }
1255
1256         if (!path_is_absolute(root_new))
1257                 return -EINVAL;
1258         if (root_old && !path_is_absolute(root_old))
1259                 return -EINVAL;
1260
1261         free_and_replace(*pivot_root_new, root_new);
1262         free_and_replace(*pivot_root_old, root_old);
1263
1264         return 0;
1265 }
1266
1267 int setup_pivot_root(const char *directory, const char *pivot_root_new, const char *pivot_root_old) {
1268         _cleanup_free_ char *directory_pivot_root_new = NULL;
1269         _cleanup_free_ char *pivot_tmp_pivot_root_old = NULL;
1270         char pivot_tmp[] = "/tmp/nspawn-pivot-XXXXXX";
1271         bool remove_pivot_tmp = false;
1272         int r;
1273
1274         assert(directory);
1275
1276         if (!pivot_root_new)
1277                 return 0;
1278
1279         /* Pivot pivot_root_new to / and the existing / to pivot_root_old.
1280          * If pivot_root_old is NULL, the existing / disappears.
1281          * This requires a temporary directory, pivot_tmp, which is
1282          * not a child of either.
1283          *
1284          * This is typically used for OSTree-style containers, where the root partition contains several
1285          * sysroots which could be run. Normally, one would be chosen by the bootloader and pivoted to / by
1286          * initrd.
1287          *
1288          * For example, for an OSTree deployment, pivot_root_new
1289          * would be: /ostree/deploy/$os/deploy/$checksum. Note that this
1290          * code doesn’t do the /var mount which OSTree expects: use
1291          * --bind +/sysroot/ostree/deploy/$os/var:/var for that.
1292          *
1293          * So in the OSTree case, we’ll end up with something like:
1294          *  - directory = /tmp/nspawn-root-123456
1295          *  - pivot_root_new = /ostree/deploy/os/deploy/123abc
1296          *  - pivot_root_old = /sysroot
1297          *  - directory_pivot_root_new =
1298          *       /tmp/nspawn-root-123456/ostree/deploy/os/deploy/123abc
1299          *  - pivot_tmp = /tmp/nspawn-pivot-123456
1300          *  - pivot_tmp_pivot_root_old = /tmp/nspawn-pivot-123456/sysroot
1301          *
1302          * Requires all file systems at directory and below to be mounted
1303          * MS_PRIVATE or MS_SLAVE so they can be moved.
1304          */
1305         directory_pivot_root_new = path_join(directory, pivot_root_new);
1306         if (!directory_pivot_root_new)
1307                 return log_oom();
1308
1309         /* Remount directory_pivot_root_new to make it movable. */
1310         r = mount_nofollow_verbose(LOG_ERR, directory_pivot_root_new, directory_pivot_root_new, NULL, MS_BIND, NULL);
1311         if (r < 0)
1312                 goto done;
1313
1314         if (pivot_root_old) {
1315                 if (!mkdtemp(pivot_tmp)) {
1316                         r = log_error_errno(errno, "Failed to create temporary directory: %m");
1317                         goto done;
1318                 }
1319
1320                 remove_pivot_tmp = true;
1321                 pivot_tmp_pivot_root_old = path_join(pivot_tmp, pivot_root_old);
1322                 if (!pivot_tmp_pivot_root_old) {
1323                         r = log_oom();
1324                         goto done;
1325                 }
1326
1327                 r = mount_nofollow_verbose(LOG_ERR, directory_pivot_root_new, pivot_tmp, NULL, MS_MOVE, NULL);
1328                 if (r < 0)
1329                         goto done;
1330
1331                 r = mount_nofollow_verbose(LOG_ERR, directory, pivot_tmp_pivot_root_old, NULL, MS_MOVE, NULL);
1332                 if (r < 0)
1333                         goto done;
1334
1335                 r = mount_nofollow_verbose(LOG_ERR, pivot_tmp, directory, NULL, MS_MOVE, NULL);
1336                 if (r < 0)
1337                         goto done;
1338         } else {
1339                 r = mount_nofollow_verbose(LOG_ERR, directory_pivot_root_new, directory, NULL, MS_MOVE, NULL);
1340                 if (r < 0)
1341                         goto done;
1342         }
1343
1344 done:
1345         if (remove_pivot_tmp)
1346                 (void) rmdir(pivot_tmp);
1347
1348         return r;
1349 }
1350
1351 #define NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS "/run/host/proc"
1352 #define NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS "/run/host/sys"
1353
1354 int pin_fully_visible_fs(void) {
1355         int r;
1356
1357         (void) mkdir_p(NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS, 0755);
1358         (void) mkdir_p(NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS, 0755);
1359
1360         r = mount_follow_verbose(LOG_ERR, "proc", NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS, "proc", PROC_DEFAULT_MOUNT_FLAGS, NULL);
1361         if (r < 0)
1362                 return r;
1363
1364         r = mount_follow_verbose(LOG_ERR, "sysfs", NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS, "sysfs", SYS_DEFAULT_MOUNT_FLAGS, NULL);
1365         if (r < 0)
1366                 return r;
1367
1368         return 0;
1369 }
1370
1371 static int do_wipe_fully_visible_fs(void) {
1372         if (umount2(NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS, MNT_DETACH) < 0)
1373                 return log_error_errno(errno, "Failed to unmount temporary proc: %m");
1374
1375         if (rmdir(NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS) < 0)
1376                 return log_error_errno(errno, "Failed to remove temporary proc mountpoint: %m");
1377
1378         if (umount2(NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS, MNT_DETACH) < 0)
1379                 return log_error_errno(errno, "Failed to unmount temporary sys: %m");
1380
1381         if (rmdir(NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS) < 0)
1382                 return log_error_errno(errno, "Failed to remove temporary sys mountpoint: %m");
1383
1384         return 0;
1385 }
1386
1387 int wipe_fully_visible_fs(int mntns_fd) {
1388         _cleanup_close_ int orig_mntns_fd = -EBADF;
1389         int r, rr;
1390
1391         r = namespace_open(0, NULL, &orig_mntns_fd, NULL, NULL, NULL);
1392         if (r < 0)
1393                 return log_error_errno(r, "Failed to pin originating mount namespace: %m");
1394
1395         r = namespace_enter(-EBADF, mntns_fd, -EBADF, -EBADF, -EBADF);
1396         if (r < 0)
1397                 return log_error_errno(r, "Failed to enter mount namespace: %m");
1398
1399         rr = do_wipe_fully_visible_fs();
1400
1401         r = namespace_enter(-EBADF, orig_mntns_fd, -EBADF, -EBADF, -EBADF);
1402         if (r < 0)
1403                 return log_error_errno(r, "Failed to enter original mount namespace: %m");
1404
1405         return rr;
1406 }