]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
sd-id128: fold do_sync flag into Id128FormatFlag
[thirdparty/systemd.git] / src / nspawn / nspawn.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #if HAVE_BLKID
4 #endif
5 #include <errno.h>
6 #include <getopt.h>
7 #include <linux/fs.h>
8 #include <linux/loop.h>
9 #if HAVE_SELINUX
10 #include <selinux/selinux.h>
11 #endif
12 #include <stdlib.h>
13 #include <sys/file.h>
14 #include <sys/ioctl.h>
15 #include <sys/personality.h>
16 #include <sys/prctl.h>
17 #include <sys/types.h>
18 #include <sys/wait.h>
19 #include <termios.h>
20 #include <unistd.h>
21
22 #include "sd-bus.h"
23 #include "sd-daemon.h"
24 #include "sd-id128.h"
25
26 #include "alloc-util.h"
27 #include "barrier.h"
28 #include "base-filesystem.h"
29 #include "blkid-util.h"
30 #include "btrfs-util.h"
31 #include "build.h"
32 #include "bus-error.h"
33 #include "bus-util.h"
34 #include "cap-list.h"
35 #include "capability-util.h"
36 #include "cgroup-util.h"
37 #include "chase-symlinks.h"
38 #include "copy.h"
39 #include "cpu-set-util.h"
40 #include "creds-util.h"
41 #include "dev-setup.h"
42 #include "discover-image.h"
43 #include "dissect-image.h"
44 #include "env-util.h"
45 #include "escape.h"
46 #include "fd-util.h"
47 #include "fdset.h"
48 #include "fileio.h"
49 #include "format-util.h"
50 #include "fs-util.h"
51 #include "gpt.h"
52 #include "hexdecoct.h"
53 #include "hostname-setup.h"
54 #include "hostname-util.h"
55 #include "id128-util.h"
56 #include "io-util.h"
57 #include "log.h"
58 #include "loop-util.h"
59 #include "loopback-setup.h"
60 #include "macro.h"
61 #include "main-func.h"
62 #include "missing_sched.h"
63 #include "mkdir.h"
64 #include "mount-util.h"
65 #include "mountpoint-util.h"
66 #include "namespace-util.h"
67 #include "netlink-util.h"
68 #include "nspawn-bind-user.h"
69 #include "nspawn-cgroup.h"
70 #include "nspawn-creds.h"
71 #include "nspawn-def.h"
72 #include "nspawn-expose-ports.h"
73 #include "nspawn-mount.h"
74 #include "nspawn-network.h"
75 #include "nspawn-oci.h"
76 #include "nspawn-patch-uid.h"
77 #include "nspawn-register.h"
78 #include "nspawn-seccomp.h"
79 #include "nspawn-settings.h"
80 #include "nspawn-setuid.h"
81 #include "nspawn-stub-pid1.h"
82 #include "nspawn-util.h"
83 #include "nspawn.h"
84 #include "nulstr-util.h"
85 #include "os-util.h"
86 #include "pager.h"
87 #include "parse-argument.h"
88 #include "parse-util.h"
89 #include "pretty-print.h"
90 #include "process-util.h"
91 #include "ptyfwd.h"
92 #include "random-util.h"
93 #include "raw-clone.h"
94 #include "resolve-util.h"
95 #include "rlimit-util.h"
96 #include "rm-rf.h"
97 #if HAVE_SECCOMP
98 #include "seccomp-util.h"
99 #endif
100 #include "selinux-util.h"
101 #include "signal-util.h"
102 #include "socket-util.h"
103 #include "stat-util.h"
104 #include "stdio-util.h"
105 #include "string-table.h"
106 #include "string-util.h"
107 #include "strv.h"
108 #include "sysctl-util.h"
109 #include "terminal-util.h"
110 #include "tmpfile-util.h"
111 #include "umask-util.h"
112 #include "unit-name.h"
113 #include "user-util.h"
114
115 /* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
116 #define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
117 #define NSPAWN_MOUNT_TUNNEL "/run/host/incoming"
118
119 #define EXIT_FORCE_RESTART 133
120
121 typedef enum ContainerStatus {
122 CONTAINER_TERMINATED,
123 CONTAINER_REBOOTED,
124 } ContainerStatus;
125
126 static char *arg_directory = NULL;
127 static char *arg_template = NULL;
128 static char *arg_chdir = NULL;
129 static char *arg_pivot_root_new = NULL;
130 static char *arg_pivot_root_old = NULL;
131 static char *arg_user = NULL;
132 static uid_t arg_uid = UID_INVALID;
133 static gid_t arg_gid = GID_INVALID;
134 static gid_t* arg_supplementary_gids = NULL;
135 static size_t arg_n_supplementary_gids = 0;
136 static sd_id128_t arg_uuid = {};
137 static char *arg_machine = NULL; /* The name used by the host to refer to this */
138 static char *arg_hostname = NULL; /* The name the payload sees by default */
139 static const char *arg_selinux_context = NULL;
140 static const char *arg_selinux_apifs_context = NULL;
141 static char *arg_slice = NULL;
142 static bool arg_private_network = false;
143 static bool arg_read_only = false;
144 static StartMode arg_start_mode = START_PID1;
145 static bool arg_ephemeral = false;
146 static LinkJournal arg_link_journal = LINK_AUTO;
147 static bool arg_link_journal_try = false;
148 static uint64_t arg_caps_retain =
149 (1ULL << CAP_AUDIT_CONTROL) |
150 (1ULL << CAP_AUDIT_WRITE) |
151 (1ULL << CAP_CHOWN) |
152 (1ULL << CAP_DAC_OVERRIDE) |
153 (1ULL << CAP_DAC_READ_SEARCH) |
154 (1ULL << CAP_FOWNER) |
155 (1ULL << CAP_FSETID) |
156 (1ULL << CAP_IPC_OWNER) |
157 (1ULL << CAP_KILL) |
158 (1ULL << CAP_LEASE) |
159 (1ULL << CAP_LINUX_IMMUTABLE) |
160 (1ULL << CAP_MKNOD) |
161 (1ULL << CAP_NET_BIND_SERVICE) |
162 (1ULL << CAP_NET_BROADCAST) |
163 (1ULL << CAP_NET_RAW) |
164 (1ULL << CAP_SETFCAP) |
165 (1ULL << CAP_SETGID) |
166 (1ULL << CAP_SETPCAP) |
167 (1ULL << CAP_SETUID) |
168 (1ULL << CAP_SYS_ADMIN) |
169 (1ULL << CAP_SYS_BOOT) |
170 (1ULL << CAP_SYS_CHROOT) |
171 (1ULL << CAP_SYS_NICE) |
172 (1ULL << CAP_SYS_PTRACE) |
173 (1ULL << CAP_SYS_RESOURCE) |
174 (1ULL << CAP_SYS_TTY_CONFIG);
175 static uint64_t arg_caps_ambient = 0;
176 static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
177 static CustomMount *arg_custom_mounts = NULL;
178 static size_t arg_n_custom_mounts = 0;
179 static char **arg_setenv = NULL;
180 static bool arg_quiet = false;
181 static bool arg_register = true;
182 static bool arg_keep_unit = false;
183 static char **arg_network_interfaces = NULL;
184 static char **arg_network_macvlan = NULL;
185 static char **arg_network_ipvlan = NULL;
186 static bool arg_network_veth = false;
187 static char **arg_network_veth_extra = NULL;
188 static char *arg_network_bridge = NULL;
189 static char *arg_network_zone = NULL;
190 static char *arg_network_namespace_path = NULL;
191 static PagerFlags arg_pager_flags = 0;
192 static unsigned long arg_personality = PERSONALITY_INVALID;
193 static char *arg_image = NULL;
194 static char *arg_oci_bundle = NULL;
195 static VolatileMode arg_volatile_mode = VOLATILE_NO;
196 static ExposePort *arg_expose_ports = NULL;
197 static char **arg_property = NULL;
198 static sd_bus_message *arg_property_message = NULL;
199 static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
200 static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
201 static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
202 static int arg_kill_signal = 0;
203 static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
204 static SettingsMask arg_settings_mask = 0;
205 static int arg_settings_trusted = -1;
206 static char **arg_parameters = NULL;
207 static const char *arg_container_service_name = "systemd-nspawn";
208 static bool arg_notify_ready = false;
209 static bool arg_use_cgns = true;
210 static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
211 static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
212 static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
213 static char **arg_syscall_allow_list = NULL;
214 static char **arg_syscall_deny_list = NULL;
215 #if HAVE_SECCOMP
216 static scmp_filter_ctx arg_seccomp = NULL;
217 #endif
218 static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
219 static bool arg_no_new_privileges = false;
220 static int arg_oom_score_adjust = 0;
221 static bool arg_oom_score_adjust_set = false;
222 static CPUSet arg_cpu_set = {};
223 static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
224 static TimezoneMode arg_timezone = TIMEZONE_AUTO;
225 static unsigned arg_console_width = UINT_MAX, arg_console_height = UINT_MAX;
226 static DeviceNode* arg_extra_nodes = NULL;
227 static size_t arg_n_extra_nodes = 0;
228 static char **arg_sysctl = NULL;
229 static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
230 static Credential *arg_credentials = NULL;
231 static size_t arg_n_credentials = 0;
232 static char **arg_bind_user = NULL;
233 static bool arg_suppress_sync = false;
234 static char *arg_settings_filename = NULL;
235
236 STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
237 STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
238 STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
239 STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
240 STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
241 STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
242 STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
243 STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
244 STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
245 STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
246 STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
247 STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
248 STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
249 STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
250 STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
251 STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
252 STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
253 STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
254 STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
255 STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
256 STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
257 STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
258 STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
259 STATIC_DESTRUCTOR_REGISTER(arg_verity_settings, verity_settings_done);
260 STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
261 STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
262 #if HAVE_SECCOMP
263 STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
264 #endif
265 STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
266 STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
267 STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
268 STATIC_DESTRUCTOR_REGISTER(arg_settings_filename, freep);
269
270 static int handle_arg_console(const char *arg) {
271 if (streq(arg, "help")) {
272 puts("autopipe\n"
273 "interactive\n"
274 "passive\n"
275 "pipe\n"
276 "read-only");
277 return 0;
278 }
279
280 if (streq(arg, "interactive"))
281 arg_console_mode = CONSOLE_INTERACTIVE;
282 else if (streq(arg, "read-only"))
283 arg_console_mode = CONSOLE_READ_ONLY;
284 else if (streq(arg, "passive"))
285 arg_console_mode = CONSOLE_PASSIVE;
286 else if (streq(arg, "pipe")) {
287 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
288 log_full(arg_quiet ? LOG_DEBUG : LOG_NOTICE,
289 "Console mode 'pipe' selected, but standard input/output are connected to an interactive TTY. "
290 "Most likely you want to use 'interactive' console mode for proper interactivity and shell job control. "
291 "Proceeding anyway.");
292
293 arg_console_mode = CONSOLE_PIPE;
294 } else if (streq(arg, "autopipe")) {
295 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
296 arg_console_mode = CONSOLE_INTERACTIVE;
297 else
298 arg_console_mode = CONSOLE_PIPE;
299 } else
300 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
301
302 arg_settings_mask |= SETTING_CONSOLE_MODE;
303 return 1;
304 }
305
306 static int help(void) {
307 _cleanup_free_ char *link = NULL;
308 int r;
309
310 pager_open(arg_pager_flags);
311
312 r = terminal_urlify_man("systemd-nspawn", "1", &link);
313 if (r < 0)
314 return log_oom();
315
316 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
317 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
318 " -h --help Show this help\n"
319 " --version Print version string\n"
320 " -q --quiet Do not show status information\n"
321 " --no-pager Do not pipe output into a pager\n"
322 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
323 "%3$sImage:%4$s\n"
324 " -D --directory=PATH Root directory for the container\n"
325 " --template=PATH Initialize root directory from template directory,\n"
326 " if missing\n"
327 " -x --ephemeral Run container with snapshot of root directory, and\n"
328 " remove it after exit\n"
329 " -i --image=PATH Root file system disk image (or device node) for\n"
330 " the container\n"
331 " --oci-bundle=PATH OCI bundle directory\n"
332 " --read-only Mount the root directory read-only\n"
333 " --volatile[=MODE] Run the system in volatile mode\n"
334 " --root-hash=HASH Specify verity root hash for root disk image\n"
335 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
336 " as a DER encoded PKCS7, either as a path to a file\n"
337 " or as an ASCII base64 encoded string prefixed by\n"
338 " 'base64:'\n"
339 " --verity-data=PATH Specify hash device for verity\n"
340 " --pivot-root=PATH[:PATH]\n"
341 " Pivot root to given directory in the container\n\n"
342 "%3$sExecution:%4$s\n"
343 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
344 " -b --boot Boot up full system (i.e. invoke init)\n"
345 " --chdir=PATH Set working directory in the container\n"
346 " -E --setenv=NAME[=VALUE] Pass an environment variable to PID 1\n"
347 " -u --user=USER Run the command under specified user or UID\n"
348 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
349 " --notify-ready=BOOLEAN Receive notifications from the child init process\n"
350 " --suppress-sync=BOOLEAN\n"
351 " Suppress any form of disk data synchronization\n\n"
352 "%3$sSystem Identity:%4$s\n"
353 " -M --machine=NAME Set the machine name for the container\n"
354 " --hostname=NAME Override the hostname for the container\n"
355 " --uuid=UUID Set a specific machine UUID for the container\n\n"
356 "%3$sProperties:%4$s\n"
357 " -S --slice=SLICE Place the container in the specified slice\n"
358 " --property=NAME=VALUE Set scope unit property\n"
359 " --register=BOOLEAN Register container as machine\n"
360 " --keep-unit Do not register a scope for the machine, reuse\n"
361 " the service unit nspawn is running in\n\n"
362 "%3$sUser Namespacing:%4$s\n"
363 " --private-users=no Run without user namespacing\n"
364 " --private-users=yes|pick|identity\n"
365 " Run within user namespace, autoselect UID/GID range\n"
366 " --private-users=UIDBASE[:NUIDS]\n"
367 " Similar, but with user configured UID/GID range\n"
368 " --private-users-ownership=MODE\n"
369 " Adjust ('chown') or map ('map') OS tree ownership\n"
370 " to private UID/GID range\n"
371 " -U Equivalent to --private-users=pick and\n"
372 " --private-users-ownership=auto\n\n"
373 "%3$sNetworking:%4$s\n"
374 " --private-network Disable network in container\n"
375 " --network-interface=INTERFACE\n"
376 " Assign an existing network interface to the\n"
377 " container\n"
378 " --network-macvlan=INTERFACE\n"
379 " Create a macvlan network interface based on an\n"
380 " existing network interface to the container\n"
381 " --network-ipvlan=INTERFACE\n"
382 " Create an ipvlan network interface based on an\n"
383 " existing network interface to the container\n"
384 " -n --network-veth Add a virtual Ethernet connection between host\n"
385 " and container\n"
386 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
387 " Add an additional virtual Ethernet link between\n"
388 " host and container\n"
389 " --network-bridge=INTERFACE\n"
390 " Add a virtual Ethernet connection to the container\n"
391 " and attach it to an existing bridge on the host\n"
392 " --network-zone=NAME Similar, but attach the new interface to an\n"
393 " an automatically managed bridge interface\n"
394 " --network-namespace-path=PATH\n"
395 " Set network namespace to the one represented by\n"
396 " the specified kernel namespace file node\n"
397 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
398 " Expose a container IP port on the host\n\n"
399 "%3$sSecurity:%4$s\n"
400 " --capability=CAP In addition to the default, retain specified\n"
401 " capability\n"
402 " --drop-capability=CAP Drop the specified capability from the default set\n"
403 " --ambient-capability=CAP\n"
404 " Sets the specified capability for the started\n"
405 " process. Not useful if booting a machine.\n"
406 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
407 " --system-call-filter=LIST|~LIST\n"
408 " Permit/prohibit specific system calls\n"
409 " -Z --selinux-context=SECLABEL\n"
410 " Set the SELinux security context to be used by\n"
411 " processes in the container\n"
412 " -L --selinux-apifs-context=SECLABEL\n"
413 " Set the SELinux security context to be used by\n"
414 " API/tmpfs file systems in the container\n\n"
415 "%3$sResources:%4$s\n"
416 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
417 " --oom-score-adjust=VALUE\n"
418 " Adjust the OOM score value for the payload\n"
419 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
420 " --personality=ARCH Pick personality for this container\n\n"
421 "%3$sIntegration:%4$s\n"
422 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
423 " --timezone=MODE Select mode of /etc/localtime initialization\n"
424 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
425 " host, try-guest, try-host\n"
426 " -j Equivalent to --link-journal=try-guest\n\n"
427 "%3$sMounts:%4$s\n"
428 " --bind=PATH[:PATH[:OPTIONS]]\n"
429 " Bind mount a file or directory from the host into\n"
430 " the container\n"
431 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
432 " Similar, but creates a read-only bind mount\n"
433 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
434 " it\n"
435 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
436 " --overlay=PATH[:PATH...]:PATH\n"
437 " Create an overlay mount from the host to \n"
438 " the container\n"
439 " --overlay-ro=PATH[:PATH...]:PATH\n"
440 " Similar, but creates a read-only overlay mount\n"
441 " --bind-user=NAME Bind user from host to container\n\n"
442 "%3$sInput/Output:%4$s\n"
443 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
444 " set up for the container.\n"
445 " -P --pipe Equivalent to --console=pipe\n\n"
446 "%3$sCredentials:%4$s\n"
447 " --set-credential=ID:VALUE\n"
448 " Pass a credential with literal value to container.\n"
449 " --load-credential=ID:PATH\n"
450 " Load credential to pass to container from file or\n"
451 " AF_UNIX stream socket.\n"
452 "\nSee the %2$s for details.\n",
453 program_invocation_short_name,
454 link,
455 ansi_underline(),
456 ansi_normal(),
457 ansi_highlight(),
458 ansi_normal());
459
460 return 0;
461 }
462
463 static int custom_mount_check_all(void) {
464 size_t i;
465
466 for (i = 0; i < arg_n_custom_mounts; i++) {
467 CustomMount *m = &arg_custom_mounts[i];
468
469 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
470 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_OFF)
471 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
472 "--private-users-ownership=own may not be combined with custom root mounts.");
473 if (arg_uid_shift == UID_INVALID)
474 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
475 "--private-users with automatic UID shift may not be combined with custom root mounts.");
476 }
477 }
478
479 return 0;
480 }
481
482 static int detect_unified_cgroup_hierarchy_from_environment(void) {
483 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
484 int r;
485
486 /* Allow the user to control whether the unified hierarchy is used */
487
488 e = getenv(var);
489 if (!e) {
490 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
491 var = "UNIFIED_CGROUP_HIERARCHY";
492 e = getenv(var);
493 }
494
495 if (!isempty(e)) {
496 r = parse_boolean(e);
497 if (r < 0)
498 return log_error_errno(r, "Failed to parse $%s: %m", var);
499 if (r > 0)
500 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
501 else
502 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
503 }
504
505 return 0;
506 }
507
508 static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
509 int r;
510
511 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
512 * in the image actually supports. */
513 r = cg_all_unified();
514 if (r < 0)
515 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
516 if (r > 0) {
517 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
518 * routine only detects 231, so we'll have a false negative here for 230. */
519 r = systemd_installation_has_version(directory, "230");
520 if (r < 0)
521 return log_error_errno(r, "Failed to determine systemd version in container: %m");
522 if (r > 0)
523 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
524 else
525 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
526 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
527 /* Mixed cgroup hierarchy support was added in 233 */
528 r = systemd_installation_has_version(directory, "233");
529 if (r < 0)
530 return log_error_errno(r, "Failed to determine systemd version in container: %m");
531 if (r > 0)
532 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
533 else
534 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
535 } else
536 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
537
538 log_debug("Using %s hierarchy for container.",
539 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
540 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
541
542 return 0;
543 }
544
545 static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
546 uint64_t mask = 0;
547 int r;
548
549 for (;;) {
550 _cleanup_free_ char *t = NULL;
551
552 r = extract_first_word(&spec, &t, ",", 0);
553 if (r < 0)
554 return log_error_errno(r, "Failed to parse capability %s.", t);
555 if (r == 0)
556 break;
557
558 if (streq(t, "help")) {
559 for (int i = 0; i < capability_list_length(); i++) {
560 const char *name;
561
562 name = capability_to_name(i);
563 if (name)
564 puts(name);
565 }
566
567 return 0; /* quit */
568 }
569
570 if (streq(t, "all"))
571 mask = UINT64_MAX;
572 else {
573 r = capability_from_name(t);
574 if (r < 0)
575 return log_error_errno(r, "Failed to parse capability %s.", t);
576
577 mask |= 1ULL << r;
578 }
579 }
580
581 *ret_mask = mask;
582 return 1; /* continue */
583 }
584
585 static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
586 int r;
587
588 r = getenv_bool(name);
589 if (r == -ENXIO)
590 return 0;
591 if (r < 0)
592 return log_error_errno(r, "Failed to parse $%s: %m", name);
593
594 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
595 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
596 return 0;
597 }
598
599 static int parse_mount_settings_env(void) {
600 const char *e;
601 int r;
602
603 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
604 if (r < 0 && r != -ENXIO)
605 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
606 if (r >= 0)
607 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
608
609 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
610 if (streq_ptr(e, "network"))
611 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
612
613 else if (e) {
614 r = parse_boolean(e);
615 if (r < 0)
616 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
617
618 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
619 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
620 }
621
622 return 0;
623 }
624
625 static int parse_environment(void) {
626 const char *e;
627 int r;
628
629 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
630 if (r < 0)
631 return r;
632 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
633 if (r < 0)
634 return r;
635 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
636 if (r < 0)
637 return r;
638 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
639 if (r < 0)
640 return r;
641
642 r = parse_mount_settings_env();
643 if (r < 0)
644 return r;
645
646 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
647 * even if it is supported. If not supported, it has no effect. */
648 if (!cg_ns_supported())
649 arg_use_cgns = false;
650 else {
651 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
652 if (r < 0) {
653 if (r != -ENXIO)
654 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
655
656 arg_use_cgns = true;
657 } else {
658 arg_use_cgns = r > 0;
659 arg_settings_mask |= SETTING_USE_CGNS;
660 }
661 }
662
663 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
664 if (e)
665 arg_container_service_name = e;
666
667 r = getenv_bool("SYSTEMD_SUPPRESS_SYNC");
668 if (r >= 0)
669 arg_suppress_sync = r;
670 else if (r != -ENXIO)
671 log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
672
673 return detect_unified_cgroup_hierarchy_from_environment();
674 }
675
676 static int parse_argv(int argc, char *argv[]) {
677 enum {
678 ARG_VERSION = 0x100,
679 ARG_PRIVATE_NETWORK,
680 ARG_UUID,
681 ARG_READ_ONLY,
682 ARG_CAPABILITY,
683 ARG_AMBIENT_CAPABILITY,
684 ARG_DROP_CAPABILITY,
685 ARG_LINK_JOURNAL,
686 ARG_BIND,
687 ARG_BIND_RO,
688 ARG_TMPFS,
689 ARG_OVERLAY,
690 ARG_OVERLAY_RO,
691 ARG_INACCESSIBLE,
692 ARG_SHARE_SYSTEM,
693 ARG_REGISTER,
694 ARG_KEEP_UNIT,
695 ARG_NETWORK_INTERFACE,
696 ARG_NETWORK_MACVLAN,
697 ARG_NETWORK_IPVLAN,
698 ARG_NETWORK_BRIDGE,
699 ARG_NETWORK_ZONE,
700 ARG_NETWORK_VETH_EXTRA,
701 ARG_NETWORK_NAMESPACE_PATH,
702 ARG_PERSONALITY,
703 ARG_VOLATILE,
704 ARG_TEMPLATE,
705 ARG_PROPERTY,
706 ARG_PRIVATE_USERS,
707 ARG_KILL_SIGNAL,
708 ARG_SETTINGS,
709 ARG_CHDIR,
710 ARG_PIVOT_ROOT,
711 ARG_PRIVATE_USERS_CHOWN,
712 ARG_PRIVATE_USERS_OWNERSHIP,
713 ARG_NOTIFY_READY,
714 ARG_ROOT_HASH,
715 ARG_ROOT_HASH_SIG,
716 ARG_VERITY_DATA,
717 ARG_SYSTEM_CALL_FILTER,
718 ARG_RLIMIT,
719 ARG_HOSTNAME,
720 ARG_NO_NEW_PRIVILEGES,
721 ARG_OOM_SCORE_ADJUST,
722 ARG_CPU_AFFINITY,
723 ARG_RESOLV_CONF,
724 ARG_TIMEZONE,
725 ARG_CONSOLE,
726 ARG_PIPE,
727 ARG_OCI_BUNDLE,
728 ARG_NO_PAGER,
729 ARG_SET_CREDENTIAL,
730 ARG_LOAD_CREDENTIAL,
731 ARG_BIND_USER,
732 ARG_SUPPRESS_SYNC,
733 };
734
735 static const struct option options[] = {
736 { "help", no_argument, NULL, 'h' },
737 { "version", no_argument, NULL, ARG_VERSION },
738 { "directory", required_argument, NULL, 'D' },
739 { "template", required_argument, NULL, ARG_TEMPLATE },
740 { "ephemeral", no_argument, NULL, 'x' },
741 { "user", required_argument, NULL, 'u' },
742 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
743 { "as-pid2", no_argument, NULL, 'a' },
744 { "boot", no_argument, NULL, 'b' },
745 { "uuid", required_argument, NULL, ARG_UUID },
746 { "read-only", no_argument, NULL, ARG_READ_ONLY },
747 { "capability", required_argument, NULL, ARG_CAPABILITY },
748 { "ambient-capability", required_argument, NULL, ARG_AMBIENT_CAPABILITY },
749 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
750 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
751 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
752 { "bind", required_argument, NULL, ARG_BIND },
753 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
754 { "tmpfs", required_argument, NULL, ARG_TMPFS },
755 { "overlay", required_argument, NULL, ARG_OVERLAY },
756 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
757 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
758 { "machine", required_argument, NULL, 'M' },
759 { "hostname", required_argument, NULL, ARG_HOSTNAME },
760 { "slice", required_argument, NULL, 'S' },
761 { "setenv", required_argument, NULL, 'E' },
762 { "selinux-context", required_argument, NULL, 'Z' },
763 { "selinux-apifs-context", required_argument, NULL, 'L' },
764 { "quiet", no_argument, NULL, 'q' },
765 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
766 { "register", required_argument, NULL, ARG_REGISTER },
767 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
768 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
769 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
770 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
771 { "network-veth", no_argument, NULL, 'n' },
772 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
773 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
774 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
775 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
776 { "personality", required_argument, NULL, ARG_PERSONALITY },
777 { "image", required_argument, NULL, 'i' },
778 { "volatile", optional_argument, NULL, ARG_VOLATILE },
779 { "port", required_argument, NULL, 'p' },
780 { "property", required_argument, NULL, ARG_PROPERTY },
781 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
782 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN }, /* obsolete */
783 { "private-users-ownership",required_argument, NULL, ARG_PRIVATE_USERS_OWNERSHIP},
784 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
785 { "settings", required_argument, NULL, ARG_SETTINGS },
786 { "chdir", required_argument, NULL, ARG_CHDIR },
787 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
788 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
789 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
790 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
791 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
792 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
793 { "rlimit", required_argument, NULL, ARG_RLIMIT },
794 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
795 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
796 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
797 { "timezone", required_argument, NULL, ARG_TIMEZONE },
798 { "console", required_argument, NULL, ARG_CONSOLE },
799 { "pipe", no_argument, NULL, ARG_PIPE },
800 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
801 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
802 { "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
803 { "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
804 { "bind-user", required_argument, NULL, ARG_BIND_USER },
805 { "suppress-sync", required_argument, NULL, ARG_SUPPRESS_SYNC },
806 {}
807 };
808
809 int c, r;
810 uint64_t plus = 0, minus = 0;
811 bool mask_all_settings = false, mask_no_settings = false;
812
813 assert(argc >= 0);
814 assert(argv);
815
816 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
817 switch (c) {
818
819 case 'h':
820 return help();
821
822 case ARG_VERSION:
823 return version();
824
825 case 'D':
826 r = parse_path_argument(optarg, false, &arg_directory);
827 if (r < 0)
828 return r;
829
830 arg_settings_mask |= SETTING_DIRECTORY;
831 break;
832
833 case ARG_TEMPLATE:
834 r = parse_path_argument(optarg, false, &arg_template);
835 if (r < 0)
836 return r;
837
838 arg_settings_mask |= SETTING_DIRECTORY;
839 break;
840
841 case 'i':
842 r = parse_path_argument(optarg, false, &arg_image);
843 if (r < 0)
844 return r;
845
846 arg_settings_mask |= SETTING_DIRECTORY;
847 break;
848
849 case ARG_OCI_BUNDLE:
850 r = parse_path_argument(optarg, false, &arg_oci_bundle);
851 if (r < 0)
852 return r;
853
854 break;
855
856 case 'x':
857 arg_ephemeral = true;
858 arg_settings_mask |= SETTING_EPHEMERAL;
859 break;
860
861 case 'u':
862 r = free_and_strdup(&arg_user, optarg);
863 if (r < 0)
864 return log_oom();
865
866 arg_settings_mask |= SETTING_USER;
867 break;
868
869 case ARG_NETWORK_ZONE: {
870 char *j;
871
872 j = strjoin("vz-", optarg);
873 if (!j)
874 return log_oom();
875
876 if (!ifname_valid(j)) {
877 log_error("Network zone name not valid: %s", j);
878 free(j);
879 return -EINVAL;
880 }
881
882 free_and_replace(arg_network_zone, j);
883
884 arg_network_veth = true;
885 arg_private_network = true;
886 arg_settings_mask |= SETTING_NETWORK;
887 break;
888 }
889
890 case ARG_NETWORK_BRIDGE:
891
892 if (!ifname_valid(optarg))
893 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
894 "Bridge interface name not valid: %s", optarg);
895
896 r = free_and_strdup(&arg_network_bridge, optarg);
897 if (r < 0)
898 return log_oom();
899
900 _fallthrough_;
901 case 'n':
902 arg_network_veth = true;
903 arg_private_network = true;
904 arg_settings_mask |= SETTING_NETWORK;
905 break;
906
907 case ARG_NETWORK_VETH_EXTRA:
908 r = veth_extra_parse(&arg_network_veth_extra, optarg);
909 if (r < 0)
910 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
911
912 arg_private_network = true;
913 arg_settings_mask |= SETTING_NETWORK;
914 break;
915
916 case ARG_NETWORK_INTERFACE:
917 if (!ifname_valid(optarg))
918 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
919 "Network interface name not valid: %s", optarg);
920
921 r = test_network_interface_initialized(optarg);
922 if (r < 0)
923 return r;
924
925 if (strv_extend(&arg_network_interfaces, optarg) < 0)
926 return log_oom();
927
928 arg_private_network = true;
929 arg_settings_mask |= SETTING_NETWORK;
930 break;
931
932 case ARG_NETWORK_MACVLAN:
933
934 if (!ifname_valid(optarg))
935 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
936 "MACVLAN network interface name not valid: %s", optarg);
937
938 r = test_network_interface_initialized(optarg);
939 if (r < 0)
940 return r;
941
942 if (strv_extend(&arg_network_macvlan, optarg) < 0)
943 return log_oom();
944
945 arg_private_network = true;
946 arg_settings_mask |= SETTING_NETWORK;
947 break;
948
949 case ARG_NETWORK_IPVLAN:
950
951 if (!ifname_valid(optarg))
952 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
953 "IPVLAN network interface name not valid: %s", optarg);
954
955 r = test_network_interface_initialized(optarg);
956 if (r < 0)
957 return r;
958
959 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
960 return log_oom();
961
962 _fallthrough_;
963 case ARG_PRIVATE_NETWORK:
964 arg_private_network = true;
965 arg_settings_mask |= SETTING_NETWORK;
966 break;
967
968 case ARG_NETWORK_NAMESPACE_PATH:
969 r = parse_path_argument(optarg, false, &arg_network_namespace_path);
970 if (r < 0)
971 return r;
972
973 arg_settings_mask |= SETTING_NETWORK;
974 break;
975
976 case 'b':
977 if (arg_start_mode == START_PID2)
978 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
979 "--boot and --as-pid2 may not be combined.");
980
981 arg_start_mode = START_BOOT;
982 arg_settings_mask |= SETTING_START_MODE;
983 break;
984
985 case 'a':
986 if (arg_start_mode == START_BOOT)
987 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
988 "--boot and --as-pid2 may not be combined.");
989
990 arg_start_mode = START_PID2;
991 arg_settings_mask |= SETTING_START_MODE;
992 break;
993
994 case ARG_UUID:
995 r = sd_id128_from_string(optarg, &arg_uuid);
996 if (r < 0)
997 return log_error_errno(r, "Invalid UUID: %s", optarg);
998
999 if (sd_id128_is_null(arg_uuid))
1000 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1001 "Machine UUID may not be all zeroes.");
1002
1003 arg_settings_mask |= SETTING_MACHINE_ID;
1004 break;
1005
1006 case 'S': {
1007 _cleanup_free_ char *mangled = NULL;
1008
1009 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
1010 if (r < 0)
1011 return log_oom();
1012
1013 free_and_replace(arg_slice, mangled);
1014 arg_settings_mask |= SETTING_SLICE;
1015 break;
1016 }
1017
1018 case 'M':
1019 if (isempty(optarg))
1020 arg_machine = mfree(arg_machine);
1021 else {
1022 if (!hostname_is_valid(optarg, 0))
1023 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1024 "Invalid machine name: %s", optarg);
1025
1026 r = free_and_strdup(&arg_machine, optarg);
1027 if (r < 0)
1028 return log_oom();
1029 }
1030 break;
1031
1032 case ARG_HOSTNAME:
1033 if (isempty(optarg))
1034 arg_hostname = mfree(arg_hostname);
1035 else {
1036 if (!hostname_is_valid(optarg, 0))
1037 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1038 "Invalid hostname: %s", optarg);
1039
1040 r = free_and_strdup(&arg_hostname, optarg);
1041 if (r < 0)
1042 return log_oom();
1043 }
1044
1045 arg_settings_mask |= SETTING_HOSTNAME;
1046 break;
1047
1048 case 'Z':
1049 arg_selinux_context = optarg;
1050 break;
1051
1052 case 'L':
1053 arg_selinux_apifs_context = optarg;
1054 break;
1055
1056 case ARG_READ_ONLY:
1057 arg_read_only = true;
1058 arg_settings_mask |= SETTING_READ_ONLY;
1059 break;
1060
1061 case ARG_AMBIENT_CAPABILITY: {
1062 uint64_t m;
1063 r = parse_capability_spec(optarg, &m);
1064 if (r <= 0)
1065 return r;
1066 arg_caps_ambient |= m;
1067 arg_settings_mask |= SETTING_CAPABILITY;
1068 break;
1069 }
1070 case ARG_CAPABILITY:
1071 case ARG_DROP_CAPABILITY: {
1072 uint64_t m;
1073 r = parse_capability_spec(optarg, &m);
1074 if (r <= 0)
1075 return r;
1076
1077 if (c == ARG_CAPABILITY)
1078 plus |= m;
1079 else
1080 minus |= m;
1081 arg_settings_mask |= SETTING_CAPABILITY;
1082 break;
1083 }
1084 case ARG_NO_NEW_PRIVILEGES:
1085 r = parse_boolean(optarg);
1086 if (r < 0)
1087 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1088
1089 arg_no_new_privileges = r;
1090 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1091 break;
1092
1093 case 'j':
1094 arg_link_journal = LINK_GUEST;
1095 arg_link_journal_try = true;
1096 arg_settings_mask |= SETTING_LINK_JOURNAL;
1097 break;
1098
1099 case ARG_LINK_JOURNAL:
1100 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
1101 if (r < 0)
1102 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
1103
1104 arg_settings_mask |= SETTING_LINK_JOURNAL;
1105 break;
1106
1107 case ARG_BIND:
1108 case ARG_BIND_RO:
1109 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1110 if (r < 0)
1111 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
1112
1113 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1114 break;
1115
1116 case ARG_TMPFS:
1117 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1118 if (r < 0)
1119 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
1120
1121 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1122 break;
1123
1124 case ARG_OVERLAY:
1125 case ARG_OVERLAY_RO:
1126 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1127 if (r == -EADDRNOTAVAIL)
1128 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1129 if (r < 0)
1130 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
1131
1132 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1133 break;
1134
1135 case ARG_INACCESSIBLE:
1136 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1137 if (r < 0)
1138 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1139
1140 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1141 break;
1142
1143 case 'E':
1144 r = strv_env_replace_strdup_passthrough(&arg_setenv, optarg);
1145 if (r < 0)
1146 return log_error_errno(r, "Cannot assign environment variable %s: %m", optarg);
1147
1148 arg_settings_mask |= SETTING_ENVIRONMENT;
1149 break;
1150
1151 case 'q':
1152 arg_quiet = true;
1153 break;
1154
1155 case ARG_SHARE_SYSTEM:
1156 /* We don't officially support this anymore, except for compat reasons. People should use the
1157 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
1158 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
1159 arg_clone_ns_flags = 0;
1160 break;
1161
1162 case ARG_REGISTER:
1163 r = parse_boolean(optarg);
1164 if (r < 0) {
1165 log_error("Failed to parse --register= argument: %s", optarg);
1166 return r;
1167 }
1168
1169 arg_register = r;
1170 break;
1171
1172 case ARG_KEEP_UNIT:
1173 arg_keep_unit = true;
1174 break;
1175
1176 case ARG_PERSONALITY:
1177
1178 arg_personality = personality_from_string(optarg);
1179 if (arg_personality == PERSONALITY_INVALID)
1180 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1181 "Unknown or unsupported personality '%s'.", optarg);
1182
1183 arg_settings_mask |= SETTING_PERSONALITY;
1184 break;
1185
1186 case ARG_VOLATILE:
1187
1188 if (!optarg)
1189 arg_volatile_mode = VOLATILE_YES;
1190 else if (streq(optarg, "help")) {
1191 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1192 return 0;
1193 } else {
1194 VolatileMode m;
1195
1196 m = volatile_mode_from_string(optarg);
1197 if (m < 0)
1198 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1199 "Failed to parse --volatile= argument: %s", optarg);
1200 else
1201 arg_volatile_mode = m;
1202 }
1203
1204 arg_settings_mask |= SETTING_VOLATILE_MODE;
1205 break;
1206
1207 case 'p':
1208 r = expose_port_parse(&arg_expose_ports, optarg);
1209 if (r == -EEXIST)
1210 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1211 if (r < 0)
1212 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
1213
1214 arg_settings_mask |= SETTING_EXPOSE_PORTS;
1215 break;
1216
1217 case ARG_PROPERTY:
1218 if (strv_extend(&arg_property, optarg) < 0)
1219 return log_oom();
1220
1221 break;
1222
1223 case ARG_PRIVATE_USERS: {
1224 int boolean;
1225
1226 if (!optarg)
1227 boolean = true;
1228 else if (!in_charset(optarg, DIGITS))
1229 /* do *not* parse numbers as booleans */
1230 boolean = parse_boolean(optarg);
1231 else
1232 boolean = -1;
1233
1234 if (boolean == 0) {
1235 /* no: User namespacing off */
1236 arg_userns_mode = USER_NAMESPACE_NO;
1237 arg_uid_shift = UID_INVALID;
1238 arg_uid_range = UINT32_C(0x10000);
1239 } else if (boolean > 0) {
1240 /* yes: User namespacing on, UID range is read from root dir */
1241 arg_userns_mode = USER_NAMESPACE_FIXED;
1242 arg_uid_shift = UID_INVALID;
1243 arg_uid_range = UINT32_C(0x10000);
1244 } else if (streq(optarg, "pick")) {
1245 /* pick: User namespacing on, UID range is picked randomly */
1246 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1247 * implied by USER_NAMESPACE_PICK
1248 * further down. */
1249 arg_uid_shift = UID_INVALID;
1250 arg_uid_range = UINT32_C(0x10000);
1251
1252 } else if (streq(optarg, "identity")) {
1253 /* identity: User namespaces on, UID range is map the 0…0xFFFF range to
1254 * itself, i.e. we don't actually map anything, but do take benefit of
1255 * isolation of capability sets. */
1256 arg_userns_mode = USER_NAMESPACE_FIXED;
1257 arg_uid_shift = 0;
1258 arg_uid_range = UINT32_C(0x10000);
1259 } else {
1260 _cleanup_free_ char *buffer = NULL;
1261 const char *range, *shift;
1262
1263 /* anything else: User namespacing on, UID range is explicitly configured */
1264
1265 range = strchr(optarg, ':');
1266 if (range) {
1267 buffer = strndup(optarg, range - optarg);
1268 if (!buffer)
1269 return log_oom();
1270 shift = buffer;
1271
1272 range++;
1273 r = safe_atou32(range, &arg_uid_range);
1274 if (r < 0)
1275 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
1276 } else
1277 shift = optarg;
1278
1279 r = parse_uid(shift, &arg_uid_shift);
1280 if (r < 0)
1281 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
1282
1283 arg_userns_mode = USER_NAMESPACE_FIXED;
1284
1285 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
1286 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID range cannot be empty or go beyond " UID_FMT ".", UID_INVALID);
1287 }
1288
1289 arg_settings_mask |= SETTING_USERNS;
1290 break;
1291 }
1292
1293 case 'U':
1294 if (userns_supported()) {
1295 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1296 * implied by USER_NAMESPACE_PICK
1297 * further down. */
1298 arg_uid_shift = UID_INVALID;
1299 arg_uid_range = UINT32_C(0x10000);
1300
1301 arg_settings_mask |= SETTING_USERNS;
1302 }
1303
1304 break;
1305
1306 case ARG_PRIVATE_USERS_CHOWN:
1307 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
1308
1309 arg_settings_mask |= SETTING_USERNS;
1310 break;
1311
1312 case ARG_PRIVATE_USERS_OWNERSHIP:
1313 if (streq(optarg, "help")) {
1314 DUMP_STRING_TABLE(user_namespace_ownership, UserNamespaceOwnership, _USER_NAMESPACE_OWNERSHIP_MAX);
1315 return 0;
1316 }
1317
1318 arg_userns_ownership = user_namespace_ownership_from_string(optarg);
1319 if (arg_userns_ownership < 0)
1320 return log_error_errno(arg_userns_ownership, "Cannot parse --user-namespace-ownership= value: %s", optarg);
1321
1322 arg_settings_mask |= SETTING_USERNS;
1323 break;
1324
1325 case ARG_KILL_SIGNAL:
1326 if (streq(optarg, "help")) {
1327 DUMP_STRING_TABLE(signal, int, _NSIG);
1328 return 0;
1329 }
1330
1331 arg_kill_signal = signal_from_string(optarg);
1332 if (arg_kill_signal < 0)
1333 return log_error_errno(arg_kill_signal, "Cannot parse signal: %s", optarg);
1334
1335 arg_settings_mask |= SETTING_KILL_SIGNAL;
1336 break;
1337
1338 case ARG_SETTINGS:
1339
1340 /* no → do not read files
1341 * yes → read files, do not override cmdline, trust only subset
1342 * override → read files, override cmdline, trust only subset
1343 * trusted → read files, do not override cmdline, trust all
1344 */
1345
1346 r = parse_boolean(optarg);
1347 if (r < 0) {
1348 if (streq(optarg, "trusted")) {
1349 mask_all_settings = false;
1350 mask_no_settings = false;
1351 arg_settings_trusted = true;
1352
1353 } else if (streq(optarg, "override")) {
1354 mask_all_settings = false;
1355 mask_no_settings = true;
1356 arg_settings_trusted = -1;
1357 } else
1358 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1359 } else if (r > 0) {
1360 /* yes */
1361 mask_all_settings = false;
1362 mask_no_settings = false;
1363 arg_settings_trusted = -1;
1364 } else {
1365 /* no */
1366 mask_all_settings = true;
1367 mask_no_settings = false;
1368 arg_settings_trusted = false;
1369 }
1370
1371 break;
1372
1373 case ARG_CHDIR:
1374 if (!path_is_absolute(optarg))
1375 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1376 "Working directory %s is not an absolute path.", optarg);
1377
1378 r = free_and_strdup(&arg_chdir, optarg);
1379 if (r < 0)
1380 return log_oom();
1381
1382 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1383 break;
1384
1385 case ARG_PIVOT_ROOT:
1386 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1387 if (r < 0)
1388 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1389
1390 arg_settings_mask |= SETTING_PIVOT_ROOT;
1391 break;
1392
1393 case ARG_NOTIFY_READY:
1394 r = parse_boolean(optarg);
1395 if (r < 0)
1396 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1397 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
1398 arg_notify_ready = r;
1399 arg_settings_mask |= SETTING_NOTIFY_READY;
1400 break;
1401
1402 case ARG_ROOT_HASH: {
1403 _cleanup_free_ void *k = NULL;
1404 size_t l;
1405
1406 r = unhexmem(optarg, strlen(optarg), &k, &l);
1407 if (r < 0)
1408 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
1409 if (l < sizeof(sd_id128_t))
1410 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
1411
1412 free_and_replace(arg_verity_settings.root_hash, k);
1413 arg_verity_settings.root_hash_size = l;
1414 break;
1415 }
1416
1417 case ARG_ROOT_HASH_SIG: {
1418 char *value;
1419 size_t l;
1420 void *p;
1421
1422 if ((value = startswith(optarg, "base64:"))) {
1423 r = unbase64mem(value, strlen(value), &p, &l);
1424 if (r < 0)
1425 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1426
1427 } else {
1428 r = read_full_file(optarg, (char**) &p, &l);
1429 if (r < 0)
1430 return log_error_errno(r, "Failed parse root hash signature file '%s': %m", optarg);
1431 }
1432
1433 free_and_replace(arg_verity_settings.root_hash_sig, p);
1434 arg_verity_settings.root_hash_sig_size = l;
1435 break;
1436 }
1437
1438 case ARG_VERITY_DATA:
1439 r = parse_path_argument(optarg, false, &arg_verity_settings.data_path);
1440 if (r < 0)
1441 return r;
1442 break;
1443
1444 case ARG_SYSTEM_CALL_FILTER: {
1445 bool negative;
1446 const char *items;
1447
1448 negative = optarg[0] == '~';
1449 items = negative ? optarg + 1 : optarg;
1450
1451 for (;;) {
1452 _cleanup_free_ char *word = NULL;
1453
1454 r = extract_first_word(&items, &word, NULL, 0);
1455 if (r == 0)
1456 break;
1457 if (r == -ENOMEM)
1458 return log_oom();
1459 if (r < 0)
1460 return log_error_errno(r, "Failed to parse system call filter: %m");
1461
1462 if (negative)
1463 r = strv_extend(&arg_syscall_deny_list, word);
1464 else
1465 r = strv_extend(&arg_syscall_allow_list, word);
1466 if (r < 0)
1467 return log_oom();
1468 }
1469
1470 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1471 break;
1472 }
1473
1474 case ARG_RLIMIT: {
1475 const char *eq;
1476 _cleanup_free_ char *name = NULL;
1477 int rl;
1478
1479 if (streq(optarg, "help")) {
1480 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1481 return 0;
1482 }
1483
1484 eq = strchr(optarg, '=');
1485 if (!eq)
1486 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1487 "--rlimit= expects an '=' assignment.");
1488
1489 name = strndup(optarg, eq - optarg);
1490 if (!name)
1491 return log_oom();
1492
1493 rl = rlimit_from_string_harder(name);
1494 if (rl < 0)
1495 return log_error_errno(rl, "Unknown resource limit: %s", name);
1496
1497 if (!arg_rlimit[rl]) {
1498 arg_rlimit[rl] = new0(struct rlimit, 1);
1499 if (!arg_rlimit[rl])
1500 return log_oom();
1501 }
1502
1503 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1504 if (r < 0)
1505 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1506
1507 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1508 break;
1509 }
1510
1511 case ARG_OOM_SCORE_ADJUST:
1512 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1513 if (r < 0)
1514 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1515
1516 arg_oom_score_adjust_set = true;
1517 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1518 break;
1519
1520 case ARG_CPU_AFFINITY: {
1521 CPUSet cpuset;
1522
1523 r = parse_cpu_set(optarg, &cpuset);
1524 if (r < 0)
1525 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
1526
1527 cpu_set_reset(&arg_cpu_set);
1528 arg_cpu_set = cpuset;
1529 arg_settings_mask |= SETTING_CPU_AFFINITY;
1530 break;
1531 }
1532
1533 case ARG_RESOLV_CONF:
1534 if (streq(optarg, "help")) {
1535 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1536 return 0;
1537 }
1538
1539 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
1540 if (arg_resolv_conf < 0)
1541 return log_error_errno(arg_resolv_conf,
1542 "Failed to parse /etc/resolv.conf mode: %s", optarg);
1543
1544 arg_settings_mask |= SETTING_RESOLV_CONF;
1545 break;
1546
1547 case ARG_TIMEZONE:
1548 if (streq(optarg, "help")) {
1549 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1550 return 0;
1551 }
1552
1553 arg_timezone = timezone_mode_from_string(optarg);
1554 if (arg_timezone < 0)
1555 return log_error_errno(arg_timezone,
1556 "Failed to parse /etc/localtime mode: %s", optarg);
1557
1558 arg_settings_mask |= SETTING_TIMEZONE;
1559 break;
1560
1561 case ARG_CONSOLE:
1562 r = handle_arg_console(optarg);
1563 if (r <= 0)
1564 return r;
1565 break;
1566
1567 case 'P':
1568 case ARG_PIPE:
1569 r = handle_arg_console("pipe");
1570 if (r <= 0)
1571 return r;
1572 break;
1573
1574 case ARG_NO_PAGER:
1575 arg_pager_flags |= PAGER_DISABLE;
1576 break;
1577
1578 case ARG_SET_CREDENTIAL: {
1579 _cleanup_free_ char *word = NULL, *data = NULL;
1580 const char *p = optarg;
1581 Credential *a;
1582 ssize_t l;
1583
1584 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1585 if (r == -ENOMEM)
1586 return log_oom();
1587 if (r < 0)
1588 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1589 if (r == 0 || !p)
1590 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1591
1592 if (!credential_name_valid(word))
1593 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1594
1595 for (size_t i = 0; i < arg_n_credentials; i++)
1596 if (streq(arg_credentials[i].id, word))
1597 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1598
1599 l = cunescape(p, UNESCAPE_ACCEPT_NUL, &data);
1600 if (l < 0)
1601 return log_error_errno(l, "Failed to unescape credential data: %s", p);
1602
1603 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1604 if (!a)
1605 return log_oom();
1606
1607 a[arg_n_credentials++] = (Credential) {
1608 .id = TAKE_PTR(word),
1609 .data = TAKE_PTR(data),
1610 .size = l,
1611 };
1612
1613 arg_credentials = a;
1614
1615 arg_settings_mask |= SETTING_CREDENTIALS;
1616 break;
1617 }
1618
1619 case ARG_LOAD_CREDENTIAL: {
1620 ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
1621 _cleanup_(erase_and_freep) char *data = NULL;
1622 _cleanup_free_ char *word = NULL, *j = NULL;
1623 const char *p = optarg;
1624 Credential *a;
1625 size_t size, i;
1626
1627 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1628 if (r == -ENOMEM)
1629 return log_oom();
1630 if (r < 0)
1631 return log_error_errno(r, "Failed to parse --load-credential= parameter: %m");
1632 if (r == 0 || !p)
1633 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --load-credential=: %s", optarg);
1634
1635 if (!credential_name_valid(word))
1636 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1637
1638 for (i = 0; i < arg_n_credentials; i++)
1639 if (streq(arg_credentials[i].id, word))
1640 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1641
1642 if (path_is_absolute(p))
1643 flags |= READ_FULL_FILE_CONNECT_SOCKET;
1644 else {
1645 const char *e;
1646
1647 r = get_credentials_dir(&e);
1648 if (r < 0)
1649 return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
1650
1651 j = path_join(e, p);
1652 if (!j)
1653 return log_oom();
1654 }
1655
1656 r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
1657 flags,
1658 NULL,
1659 &data, &size);
1660 if (r < 0)
1661 return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
1662
1663 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1664 if (!a)
1665 return log_oom();
1666
1667 a[arg_n_credentials++] = (Credential) {
1668 .id = TAKE_PTR(word),
1669 .data = TAKE_PTR(data),
1670 .size = size,
1671 };
1672
1673 arg_credentials = a;
1674
1675 arg_settings_mask |= SETTING_CREDENTIALS;
1676 break;
1677 }
1678
1679 case ARG_BIND_USER:
1680 if (!valid_user_group_name(optarg, 0))
1681 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid user name to bind: %s", optarg);
1682
1683 if (strv_extend(&arg_bind_user, optarg) < 0)
1684 return log_oom();
1685
1686 arg_settings_mask |= SETTING_BIND_USER;
1687 break;
1688
1689 case ARG_SUPPRESS_SYNC:
1690 r = parse_boolean_argument("--suppress-sync=", optarg, &arg_suppress_sync);
1691 if (r < 0)
1692 return r;
1693
1694 arg_settings_mask |= SETTING_SUPPRESS_SYNC;
1695 break;
1696
1697 case '?':
1698 return -EINVAL;
1699
1700 default:
1701 assert_not_reached();
1702 }
1703
1704 if (argc > optind) {
1705 strv_free(arg_parameters);
1706 arg_parameters = strv_copy(argv + optind);
1707 if (!arg_parameters)
1708 return log_oom();
1709
1710 arg_settings_mask |= SETTING_START_MODE;
1711 }
1712
1713 if (arg_ephemeral && arg_template && !arg_directory)
1714 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1715 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1716 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1717 * --directory=". */
1718 arg_directory = TAKE_PTR(arg_template);
1719
1720 arg_caps_retain = (arg_caps_retain | plus | (arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0)) & ~minus;
1721
1722 /* Make sure to parse environment before we reset the settings mask below */
1723 r = parse_environment();
1724 if (r < 0)
1725 return r;
1726
1727 /* Load all settings from .nspawn files */
1728 if (mask_no_settings)
1729 arg_settings_mask = 0;
1730
1731 /* Don't load any settings from .nspawn files */
1732 if (mask_all_settings)
1733 arg_settings_mask = _SETTINGS_MASK_ALL;
1734
1735 return 1;
1736 }
1737
1738 static int verify_arguments(void) {
1739 int r;
1740
1741 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1742 /* If we are running the stub init in the container, we don't need to look at what the init
1743 * in the container supports, because we are not using it. Let's immediately pick the right
1744 * setting based on the host system configuration.
1745 *
1746 * We only do this, if the user didn't use an environment variable to override the detection.
1747 */
1748
1749 r = cg_all_unified();
1750 if (r < 0)
1751 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1752 if (r > 0)
1753 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1754 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1755 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1756 else
1757 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1758 }
1759
1760 if (arg_userns_mode != USER_NAMESPACE_NO)
1761 arg_mount_settings |= MOUNT_USE_USERNS;
1762
1763 if (arg_private_network)
1764 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1765
1766 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1767 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
1768 arg_register = false;
1769 if (arg_start_mode != START_PID1)
1770 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
1771 }
1772
1773 if (arg_userns_ownership < 0)
1774 arg_userns_ownership =
1775 arg_userns_mode == USER_NAMESPACE_PICK ? USER_NAMESPACE_OWNERSHIP_AUTO :
1776 USER_NAMESPACE_OWNERSHIP_OFF;
1777
1778 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1779 arg_kill_signal = SIGRTMIN+3;
1780
1781 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1782 arg_read_only = true;
1783
1784 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1785 arg_read_only = true;
1786
1787 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
1788 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1789 * The latter is not technically a user session, but we don't need to labour the point. */
1790 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
1791
1792 if (arg_directory && arg_image)
1793 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1794
1795 if (arg_template && arg_image)
1796 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
1797
1798 if (arg_template && !(arg_directory || arg_machine))
1799 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
1800
1801 if (arg_ephemeral && arg_template)
1802 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
1803
1804 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
1805 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
1806
1807 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
1808 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
1809
1810 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_read_only)
1811 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1812 "--read-only and --private-users-ownership=chown may not be combined.");
1813
1814 /* We don't support --private-users-ownership=chown together with any of the volatile modes since we
1815 * couldn't change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a
1816 * massive copy-up (in case of overlay) making the entire exercise pointless. */
1817 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_volatile_mode != VOLATILE_NO)
1818 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-ownership=chown may not be combined.");
1819
1820 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1821 * we need to error out, to avoid conflicts between different network options. */
1822 if (arg_network_namespace_path &&
1823 (arg_network_interfaces || arg_network_macvlan ||
1824 arg_network_ipvlan || arg_network_veth_extra ||
1825 arg_network_bridge || arg_network_zone ||
1826 arg_network_veth))
1827 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
1828
1829 if (arg_network_bridge && arg_network_zone)
1830 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1831 "--network-bridge= and --network-zone= may not be combined.");
1832
1833 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
1834 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
1835
1836 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
1837 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
1838
1839 if (arg_expose_ports && !arg_private_network)
1840 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
1841
1842 if (arg_caps_ambient) {
1843 if (arg_caps_ambient == UINT64_MAX)
1844 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= does not support the value all.");
1845
1846 if ((arg_caps_ambient & arg_caps_retain) != arg_caps_ambient)
1847 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not fully covered by Capability= setting.");
1848
1849 if (arg_start_mode == START_BOOT)
1850 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not useful for boot mode.");
1851 }
1852
1853 if (arg_userns_mode == USER_NAMESPACE_NO && !strv_isempty(arg_bind_user))
1854 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--bind-user= requires --private-users");
1855
1856 /* Drop duplicate --bind-user= entries */
1857 strv_uniq(arg_bind_user);
1858
1859 r = custom_mount_check_all();
1860 if (r < 0)
1861 return r;
1862
1863 return 0;
1864 }
1865
1866 int userns_lchown(const char *p, uid_t uid, gid_t gid) {
1867 assert(p);
1868
1869 if (arg_userns_mode == USER_NAMESPACE_NO)
1870 return 0;
1871
1872 if (uid == UID_INVALID && gid == GID_INVALID)
1873 return 0;
1874
1875 if (uid != UID_INVALID) {
1876 uid += arg_uid_shift;
1877
1878 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1879 return -EOVERFLOW;
1880 }
1881
1882 if (gid != GID_INVALID) {
1883 gid += (gid_t) arg_uid_shift;
1884
1885 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1886 return -EOVERFLOW;
1887 }
1888
1889 return RET_NERRNO(lchown(p, uid, gid));
1890 }
1891
1892 int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
1893 const char *q;
1894 int r;
1895
1896 q = prefix_roota(root, path);
1897 r = RET_NERRNO(mkdir(q, mode));
1898 if (r == -EEXIST)
1899 return 0;
1900 if (r < 0)
1901 return r;
1902
1903 return userns_lchown(q, uid, gid);
1904 }
1905
1906 static const char *timezone_from_path(const char *path) {
1907 return PATH_STARTSWITH_SET(
1908 path,
1909 "../usr/share/zoneinfo/",
1910 "/usr/share/zoneinfo/");
1911 }
1912
1913 static bool etc_writable(void) {
1914 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1915 }
1916
1917 static int setup_timezone(const char *dest) {
1918 _cleanup_free_ char *p = NULL, *etc = NULL;
1919 const char *where, *check;
1920 TimezoneMode m;
1921 int r;
1922
1923 assert(dest);
1924
1925 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1926 r = readlink_malloc("/etc/localtime", &p);
1927 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
1928 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1929 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
1930 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1931 else if (r < 0) {
1932 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1933 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1934 * file.
1935 *
1936 * Example:
1937 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1938 */
1939 return 0;
1940 } else if (arg_timezone == TIMEZONE_AUTO)
1941 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1942 else
1943 m = arg_timezone;
1944 } else
1945 m = arg_timezone;
1946
1947 if (m == TIMEZONE_OFF)
1948 return 0;
1949
1950 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
1951 if (r < 0) {
1952 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
1953 return 0;
1954 }
1955
1956 where = strjoina(etc, "/localtime");
1957
1958 switch (m) {
1959
1960 case TIMEZONE_DELETE:
1961 if (unlink(where) < 0)
1962 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1963
1964 return 0;
1965
1966 case TIMEZONE_SYMLINK: {
1967 _cleanup_free_ char *q = NULL;
1968 const char *z, *what;
1969
1970 z = timezone_from_path(p);
1971 if (!z) {
1972 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
1973 return 0;
1974 }
1975
1976 r = readlink_malloc(where, &q);
1977 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1978 return 0; /* Already pointing to the right place? Then do nothing .. */
1979
1980 check = strjoina(dest, "/usr/share/zoneinfo/", z);
1981 r = chase_symlinks(check, dest, 0, NULL, NULL);
1982 if (r < 0)
1983 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1984 else {
1985 if (unlink(where) < 0 && errno != ENOENT) {
1986 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1987 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1988 return 0;
1989 }
1990
1991 what = strjoina("../usr/share/zoneinfo/", z);
1992 if (symlink(what, where) < 0) {
1993 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
1994 errno, "Failed to correct timezone of container, ignoring: %m");
1995 return 0;
1996 }
1997
1998 break;
1999 }
2000
2001 _fallthrough_;
2002 }
2003
2004 case TIMEZONE_BIND: {
2005 _cleanup_free_ char *resolved = NULL;
2006 int found;
2007
2008 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
2009 if (found < 0) {
2010 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
2011 return 0;
2012 }
2013
2014 if (found == 0) /* missing? */
2015 (void) touch(resolved);
2016
2017 r = mount_nofollow_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
2018 if (r >= 0)
2019 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
2020
2021 _fallthrough_;
2022 }
2023
2024 case TIMEZONE_COPY:
2025 /* If mounting failed, try to copy */
2026 r = copy_file_atomic("/etc/localtime", where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
2027 if (r < 0) {
2028 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2029 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
2030 return 0;
2031 }
2032
2033 break;
2034
2035 default:
2036 assert_not_reached();
2037 }
2038
2039 /* Fix permissions of the symlink or file copy we just created */
2040 r = userns_lchown(where, 0, 0);
2041 if (r < 0)
2042 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
2043
2044 return 0;
2045 }
2046
2047 static int have_resolv_conf(const char *path) {
2048 assert(path);
2049
2050 if (access(path, F_OK) < 0) {
2051 if (errno == ENOENT)
2052 return 0;
2053
2054 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
2055 }
2056
2057 return 1;
2058 }
2059
2060 static int resolved_listening(void) {
2061 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2062 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2063 _cleanup_free_ char *dns_stub_listener_mode = NULL;
2064 int r;
2065
2066 /* Check if resolved is listening */
2067
2068 r = sd_bus_open_system(&bus);
2069 if (r < 0)
2070 return log_debug_errno(r, "Failed to open system bus: %m");
2071
2072 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
2073 if (r < 0)
2074 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
2075 if (r == 0)
2076 return 0;
2077
2078 r = sd_bus_get_property_string(bus,
2079 "org.freedesktop.resolve1",
2080 "/org/freedesktop/resolve1",
2081 "org.freedesktop.resolve1.Manager",
2082 "DNSStubListener",
2083 &error,
2084 &dns_stub_listener_mode);
2085 if (r < 0)
2086 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
2087
2088 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
2089 }
2090
2091 static int setup_resolv_conf(const char *dest) {
2092 _cleanup_free_ char *etc = NULL;
2093 const char *where, *what;
2094 ResolvConfMode m;
2095 int r;
2096
2097 assert(dest);
2098
2099 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
2100 if (arg_private_network)
2101 m = RESOLV_CONF_OFF;
2102 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
2103 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
2104 else if (have_resolv_conf("/etc/resolv.conf") > 0)
2105 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
2106 else
2107 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
2108
2109 } else
2110 m = arg_resolv_conf;
2111
2112 if (m == RESOLV_CONF_OFF)
2113 return 0;
2114
2115 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
2116 if (r < 0) {
2117 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
2118 return 0;
2119 }
2120
2121 where = strjoina(etc, "/resolv.conf");
2122
2123 if (m == RESOLV_CONF_DELETE) {
2124 if (unlink(where) < 0)
2125 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
2126
2127 return 0;
2128 }
2129
2130 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
2131 what = PRIVATE_STATIC_RESOLV_CONF;
2132 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
2133 what = PRIVATE_UPLINK_RESOLV_CONF;
2134 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
2135 what = PRIVATE_STUB_RESOLV_CONF;
2136 else
2137 what = "/etc/resolv.conf";
2138
2139 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
2140 _cleanup_free_ char *resolved = NULL;
2141 int found;
2142
2143 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
2144 if (found < 0) {
2145 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
2146 return 0;
2147 }
2148
2149 if (found == 0) /* missing? */
2150 (void) touch(resolved);
2151
2152 r = mount_nofollow_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
2153 if (r >= 0)
2154 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
2155
2156 /* If that didn't work, let's copy the file */
2157 }
2158
2159 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
2160 r = copy_file_atomic(what, where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
2161 else
2162 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, 0, 0, COPY_REFLINK);
2163 if (r < 0) {
2164 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
2165 * resolved or something similar runs inside and the symlink points there.
2166 *
2167 * If the disk image is read-only, there's also no point in complaining.
2168 */
2169 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
2170 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2171 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
2172 return 0;
2173 }
2174
2175 r = userns_lchown(where, 0, 0);
2176 if (r < 0)
2177 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
2178
2179 return 0;
2180 }
2181
2182 static int setup_boot_id(void) {
2183 _cleanup_(unlink_and_freep) char *from = NULL;
2184 _cleanup_free_ char *path = NULL;
2185 sd_id128_t rnd = SD_ID128_NULL;
2186 const char *to;
2187 int r;
2188
2189 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
2190
2191 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
2192 if (r < 0)
2193 return log_error_errno(r, "Failed to generate random boot ID path: %m");
2194
2195 r = sd_id128_randomize(&rnd);
2196 if (r < 0)
2197 return log_error_errno(r, "Failed to generate random boot id: %m");
2198
2199 r = id128_write(path, ID128_FORMAT_UUID, rnd);
2200 if (r < 0)
2201 return log_error_errno(r, "Failed to write boot id: %m");
2202
2203 from = TAKE_PTR(path);
2204 to = "/proc/sys/kernel/random/boot_id";
2205
2206 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
2207 if (r < 0)
2208 return r;
2209
2210 return mount_nofollow_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
2211 }
2212
2213 static int copy_devnodes(const char *dest) {
2214 static const char devnodes[] =
2215 "null\0"
2216 "zero\0"
2217 "full\0"
2218 "random\0"
2219 "urandom\0"
2220 "tty\0"
2221 "net/tun\0";
2222
2223 int r = 0;
2224
2225 assert(dest);
2226
2227 BLOCK_WITH_UMASK(0000);
2228
2229 /* Create /dev/net, so that we can create /dev/net/tun in it */
2230 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2231 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2232
2233 NULSTR_FOREACH(d, devnodes) {
2234 _cleanup_free_ char *from = NULL, *to = NULL;
2235 struct stat st;
2236
2237 from = path_join("/dev/", d);
2238 if (!from)
2239 return log_oom();
2240
2241 to = path_join(dest, from);
2242 if (!to)
2243 return log_oom();
2244
2245 if (stat(from, &st) < 0) {
2246
2247 if (errno != ENOENT)
2248 return log_error_errno(errno, "Failed to stat %s: %m", from);
2249
2250 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2251 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2252 "%s is not a char or block device, cannot copy.", from);
2253 else {
2254 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2255
2256 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
2257 /* Explicitly warn the user when /dev is already populated. */
2258 if (errno == EEXIST)
2259 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
2260 if (errno != EPERM)
2261 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2262
2263 /* Some systems abusively restrict mknod but allow bind mounts. */
2264 r = touch(to);
2265 if (r < 0)
2266 return log_error_errno(r, "touch (%s) failed: %m", to);
2267 r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
2268 if (r < 0)
2269 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
2270 }
2271
2272 r = userns_lchown(to, 0, 0);
2273 if (r < 0)
2274 return log_error_errno(r, "chown() of device node %s failed: %m", to);
2275
2276 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
2277 if (!dn)
2278 return log_oom();
2279
2280 r = userns_mkdir(dest, dn, 0755, 0, 0);
2281 if (r < 0)
2282 return log_error_errno(r, "Failed to create '%s': %m", dn);
2283
2284 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2285 return log_oom();
2286
2287 prefixed = path_join(dest, sl);
2288 if (!prefixed)
2289 return log_oom();
2290
2291 t = path_join("..", d);
2292 if (!t)
2293 return log_oom();
2294
2295 if (symlink(t, prefixed) < 0)
2296 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
2297 }
2298 }
2299
2300 return r;
2301 }
2302
2303 static int make_extra_nodes(const char *dest) {
2304 size_t i;
2305 int r;
2306
2307 BLOCK_WITH_UMASK(0000);
2308
2309 for (i = 0; i < arg_n_extra_nodes; i++) {
2310 _cleanup_free_ char *path = NULL;
2311 DeviceNode *n = arg_extra_nodes + i;
2312
2313 path = path_join(dest, n->path);
2314 if (!path)
2315 return log_oom();
2316
2317 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2318 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2319
2320 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2321 if (r < 0)
2322 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2323 }
2324
2325 return 0;
2326 }
2327
2328 static int setup_pts(const char *dest) {
2329 _cleanup_free_ char *options = NULL;
2330 const char *p;
2331 int r;
2332
2333 #if HAVE_SELINUX
2334 if (arg_selinux_apifs_context)
2335 (void) asprintf(&options,
2336 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
2337 arg_uid_shift + TTY_GID,
2338 arg_selinux_apifs_context);
2339 else
2340 #endif
2341 (void) asprintf(&options,
2342 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
2343 arg_uid_shift + TTY_GID);
2344
2345 if (!options)
2346 return log_oom();
2347
2348 /* Mount /dev/pts itself */
2349 p = prefix_roota(dest, "/dev/pts");
2350 r = RET_NERRNO(mkdir(p, 0755));
2351 if (r < 0)
2352 return log_error_errno(r, "Failed to create /dev/pts: %m");
2353
2354 r = mount_nofollow_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
2355 if (r < 0)
2356 return r;
2357 r = userns_lchown(p, 0, 0);
2358 if (r < 0)
2359 return log_error_errno(r, "Failed to chown /dev/pts: %m");
2360
2361 /* Create /dev/ptmx symlink */
2362 p = prefix_roota(dest, "/dev/ptmx");
2363 if (symlink("pts/ptmx", p) < 0)
2364 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
2365 r = userns_lchown(p, 0, 0);
2366 if (r < 0)
2367 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
2368
2369 /* And fix /dev/pts/ptmx ownership */
2370 p = prefix_roota(dest, "/dev/pts/ptmx");
2371 r = userns_lchown(p, 0, 0);
2372 if (r < 0)
2373 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
2374
2375 return 0;
2376 }
2377
2378 static int setup_stdio_as_dev_console(void) {
2379 _cleanup_close_ int terminal = -1;
2380 int r;
2381
2382 /* We open the TTY in O_NOCTTY mode, so that we do not become controller yet. We'll do that later
2383 * explicitly, if we are configured to. */
2384 terminal = open_terminal("/dev/console", O_RDWR|O_NOCTTY);
2385 if (terminal < 0)
2386 return log_error_errno(terminal, "Failed to open console: %m");
2387
2388 /* Make sure we can continue logging to the original stderr, even if
2389 * stderr points elsewhere now */
2390 r = log_dup_console();
2391 if (r < 0)
2392 return log_error_errno(r, "Failed to duplicate stderr: %m");
2393
2394 /* invalidates 'terminal' on success and failure */
2395 r = rearrange_stdio(terminal, terminal, terminal);
2396 TAKE_FD(terminal);
2397 if (r < 0)
2398 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2399
2400 return 0;
2401 }
2402
2403 static int setup_dev_console(const char *console) {
2404 _cleanup_free_ char *p = NULL;
2405 int r;
2406
2407 /* Create /dev/console symlink */
2408 r = path_make_relative("/dev", console, &p);
2409 if (r < 0)
2410 return log_error_errno(r, "Failed to create relative path: %m");
2411
2412 if (symlink(p, "/dev/console") < 0)
2413 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
2414
2415 return 0;
2416 }
2417
2418 static int setup_keyring(void) {
2419 key_serial_t keyring;
2420
2421 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2422 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2423 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2424 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2425 * into the container. */
2426
2427 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2428 if (keyring == -1) {
2429 if (errno == ENOSYS)
2430 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
2431 else if (ERRNO_IS_PRIVILEGE(errno))
2432 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2433 else
2434 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2435 }
2436
2437 return 0;
2438 }
2439
2440 static int setup_credentials(const char *root) {
2441 const char *q;
2442 int r;
2443
2444 if (arg_n_credentials <= 0)
2445 return 0;
2446
2447 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2448 if (r < 0)
2449 return log_error_errno(r, "Failed to create /run/host: %m");
2450
2451 r = userns_mkdir(root, "/run/host/credentials", 0700, 0, 0);
2452 if (r < 0)
2453 return log_error_errno(r, "Failed to create /run/host/credentials: %m");
2454
2455 q = prefix_roota(root, "/run/host/credentials");
2456 r = mount_nofollow_verbose(LOG_ERR, NULL, q, "ramfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0700");
2457 if (r < 0)
2458 return r;
2459
2460 for (size_t i = 0; i < arg_n_credentials; i++) {
2461 _cleanup_free_ char *j = NULL;
2462 _cleanup_close_ int fd = -1;
2463
2464 j = path_join(q, arg_credentials[i].id);
2465 if (!j)
2466 return log_oom();
2467
2468 fd = open(j, O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC|O_NOFOLLOW, 0600);
2469 if (fd < 0)
2470 return log_error_errno(errno, "Failed to create credential file %s: %m", j);
2471
2472 r = loop_write(fd, arg_credentials[i].data, arg_credentials[i].size, /* do_poll= */ false);
2473 if (r < 0)
2474 return log_error_errno(r, "Failed to write credential to file %s: %m", j);
2475
2476 if (fchmod(fd, 0400) < 0)
2477 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", j);
2478
2479 if (arg_userns_mode != USER_NAMESPACE_NO) {
2480 if (fchown(fd, arg_uid_shift, arg_uid_shift) < 0)
2481 return log_error_errno(errno, "Failed to adjust ownership of %s: %m", j);
2482 }
2483 }
2484
2485 if (chmod(q, 0500) < 0)
2486 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", q);
2487
2488 r = userns_lchown(q, 0, 0);
2489 if (r < 0)
2490 return r;
2491
2492 /* Make both mount and superblock read-only now */
2493 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
2494 if (r < 0)
2495 return r;
2496
2497 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0500");
2498 }
2499
2500 static int setup_kmsg(int kmsg_socket) {
2501 _cleanup_(unlink_and_freep) char *from = NULL;
2502 _cleanup_free_ char *fifo = NULL;
2503 _cleanup_close_ int fd = -1;
2504 int r;
2505
2506 assert(kmsg_socket >= 0);
2507
2508 BLOCK_WITH_UMASK(0000);
2509
2510 /* We create the kmsg FIFO as as temporary file in /run, but immediately delete it after bind mounting it to
2511 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2512 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2513 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2514
2515 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
2516 if (r < 0)
2517 return log_error_errno(r, "Failed to generate kmsg path: %m");
2518
2519 if (mkfifo(fifo, 0600) < 0)
2520 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
2521
2522 from = TAKE_PTR(fifo);
2523
2524 r = mount_nofollow_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
2525 if (r < 0)
2526 return r;
2527
2528 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
2529 if (fd < 0)
2530 return log_error_errno(errno, "Failed to open fifo: %m");
2531
2532 /* Store away the fd in the socket, so that it stays open as long as we run the child */
2533 r = send_one_fd(kmsg_socket, fd, 0);
2534 if (r < 0)
2535 return log_error_errno(r, "Failed to send FIFO fd: %m");
2536
2537 return 0;
2538 }
2539
2540 struct ExposeArgs {
2541 union in_addr_union address4;
2542 union in_addr_union address6;
2543 struct FirewallContext *fw_ctx;
2544 };
2545
2546 static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
2547 struct ExposeArgs *args = ASSERT_PTR(userdata);
2548
2549 assert(rtnl);
2550 assert(m);
2551
2552 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
2553 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
2554 return 0;
2555 }
2556
2557 static int setup_hostname(void) {
2558 int r;
2559
2560 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
2561 return 0;
2562
2563 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2564 if (r < 0)
2565 return log_error_errno(r, "Failed to set hostname: %m");
2566
2567 return 0;
2568 }
2569
2570 static int setup_journal(const char *directory) {
2571 _cleanup_free_ char *d = NULL;
2572 const char *p, *q;
2573 sd_id128_t this_id;
2574 bool try;
2575 int r;
2576
2577 /* Don't link journals in ephemeral mode */
2578 if (arg_ephemeral)
2579 return 0;
2580
2581 if (arg_link_journal == LINK_NO)
2582 return 0;
2583
2584 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2585
2586 r = sd_id128_get_machine(&this_id);
2587 if (r < 0)
2588 return log_error_errno(r, "Failed to retrieve machine ID: %m");
2589
2590 if (sd_id128_equal(arg_uuid, this_id)) {
2591 log_full(try ? LOG_WARNING : LOG_ERR,
2592 "Host and machine ids are equal (%s): refusing to link journals", SD_ID128_TO_STRING(arg_uuid));
2593 if (try)
2594 return 0;
2595 return -EEXIST;
2596 }
2597
2598 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2599 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2600 if (r < 0) {
2601 bool ignore = r == -EROFS && try;
2602 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2603 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2604 return ignore ? 0 : r;
2605 }
2606 }
2607
2608 p = strjoina("/var/log/journal/", SD_ID128_TO_STRING(arg_uuid));
2609 q = prefix_roota(directory, p);
2610
2611 if (path_is_mount_point(p, NULL, 0) > 0) {
2612 if (try)
2613 return 0;
2614
2615 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2616 "%s: already a mount point, refusing to use for journal", p);
2617 }
2618
2619 if (path_is_mount_point(q, NULL, 0) > 0) {
2620 if (try)
2621 return 0;
2622
2623 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2624 "%s: already a mount point, refusing to use for journal", q);
2625 }
2626
2627 r = readlink_and_make_absolute(p, &d);
2628 if (r >= 0) {
2629 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
2630 path_equal(d, q)) {
2631
2632 r = userns_mkdir(directory, p, 0755, 0, 0);
2633 if (r < 0)
2634 log_warning_errno(r, "Failed to create directory %s: %m", q);
2635 return 0;
2636 }
2637
2638 if (unlink(p) < 0)
2639 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
2640 } else if (r == -EINVAL) {
2641
2642 if (arg_link_journal == LINK_GUEST &&
2643 rmdir(p) < 0) {
2644
2645 if (errno == ENOTDIR) {
2646 log_error("%s already exists and is neither a symlink nor a directory", p);
2647 return r;
2648 } else
2649 return log_error_errno(errno, "Failed to remove %s: %m", p);
2650 }
2651 } else if (r != -ENOENT)
2652 return log_error_errno(r, "readlink(%s) failed: %m", p);
2653
2654 if (arg_link_journal == LINK_GUEST) {
2655
2656 if (symlink(q, p) < 0) {
2657 if (try) {
2658 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
2659 return 0;
2660 } else
2661 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
2662 }
2663
2664 r = userns_mkdir(directory, p, 0755, 0, 0);
2665 if (r < 0)
2666 log_warning_errno(r, "Failed to create directory %s: %m", q);
2667 return 0;
2668 }
2669
2670 if (arg_link_journal == LINK_HOST) {
2671 /* don't create parents here — if the host doesn't have
2672 * permanent journal set up, don't force it here */
2673
2674 r = RET_NERRNO(mkdir(p, 0755));
2675 if (r < 0 && r != -EEXIST) {
2676 if (try) {
2677 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
2678 return 0;
2679 } else
2680 return log_error_errno(r, "Failed to create %s: %m", p);
2681 }
2682
2683 } else if (access(p, F_OK) < 0)
2684 return 0;
2685
2686 if (dir_is_empty(q, /* ignore_hidden_or_backup= */ false) == 0)
2687 log_warning("%s is not empty, proceeding anyway.", q);
2688
2689 r = userns_mkdir(directory, p, 0755, 0, 0);
2690 if (r < 0)
2691 return log_error_errno(r, "Failed to create %s: %m", q);
2692
2693 r = mount_nofollow_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
2694 if (r < 0)
2695 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
2696
2697 return 0;
2698 }
2699
2700 static int drop_capabilities(uid_t uid) {
2701 CapabilityQuintet q;
2702
2703 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2704 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2705 * arg_caps_retain. */
2706
2707 if (capability_quintet_is_set(&arg_full_capabilities)) {
2708 q = arg_full_capabilities;
2709
2710 if (q.bounding == UINT64_MAX)
2711 q.bounding = uid == 0 ? arg_caps_retain : 0;
2712
2713 if (q.effective == UINT64_MAX)
2714 q.effective = uid == 0 ? q.bounding : 0;
2715
2716 if (q.inheritable == UINT64_MAX)
2717 q.inheritable = uid == 0 ? q.bounding : arg_caps_ambient;
2718
2719 if (q.permitted == UINT64_MAX)
2720 q.permitted = uid == 0 ? q.bounding : arg_caps_ambient;
2721
2722 if (q.ambient == UINT64_MAX && ambient_capabilities_supported())
2723 q.ambient = arg_caps_ambient;
2724
2725 if (capability_quintet_mangle(&q))
2726 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2727
2728 } else {
2729 q = (CapabilityQuintet) {
2730 .bounding = arg_caps_retain,
2731 .effective = uid == 0 ? arg_caps_retain : 0,
2732 .inheritable = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2733 .permitted = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2734 .ambient = ambient_capabilities_supported() ? arg_caps_ambient : UINT64_MAX,
2735 };
2736
2737 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2738 * in order to maintain the same behavior as systemd < 242. */
2739 if (capability_quintet_mangle(&q))
2740 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2741 "Some capabilities will not be set because they are not in the current bounding set.");
2742
2743 }
2744
2745 return capability_quintet_enforce(&q);
2746 }
2747
2748 static int reset_audit_loginuid(void) {
2749 _cleanup_free_ char *p = NULL;
2750 int r;
2751
2752 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
2753 return 0;
2754
2755 r = read_one_line_file("/proc/self/loginuid", &p);
2756 if (r == -ENOENT)
2757 return 0;
2758 if (r < 0)
2759 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
2760
2761 /* Already reset? */
2762 if (streq(p, "4294967295"))
2763 return 0;
2764
2765 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
2766 if (r < 0) {
2767 log_error_errno(r,
2768 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2769 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2770 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2771 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2772 "using systemd-nspawn. Sleeping for 5s... (%m)");
2773
2774 sleep(5);
2775 }
2776
2777 return 0;
2778 }
2779
2780 static int mount_tunnel_dig(const char *root) {
2781 const char *p, *q;
2782 int r;
2783
2784 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2785 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
2786 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
2787 (void) mkdir_p(p, 0600);
2788
2789 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2790 if (r < 0)
2791 return log_error_errno(r, "Failed to create /run/host: %m");
2792
2793 r = userns_mkdir(root, NSPAWN_MOUNT_TUNNEL, 0600, 0, 0);
2794 if (r < 0)
2795 return log_error_errno(r, "Failed to create "NSPAWN_MOUNT_TUNNEL": %m");
2796
2797 q = prefix_roota(root, NSPAWN_MOUNT_TUNNEL);
2798 r = mount_nofollow_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
2799 if (r < 0)
2800 return r;
2801
2802 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
2803 if (r < 0)
2804 return r;
2805
2806 return 0;
2807 }
2808
2809 static int mount_tunnel_open(void) {
2810 int r;
2811
2812 r = mount_follow_verbose(LOG_ERR, NULL, NSPAWN_MOUNT_TUNNEL, NULL, MS_SLAVE, NULL);
2813 if (r < 0)
2814 return r;
2815
2816 return 0;
2817 }
2818
2819 static int setup_machine_id(const char *directory) {
2820 const char *etc_machine_id;
2821 sd_id128_t id;
2822 int r;
2823
2824 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2825 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2826 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2827 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2828 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2829 * container behaves nicely). */
2830
2831 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2832
2833 r = id128_read(etc_machine_id, ID128_FORMAT_PLAIN, &id);
2834 if (r < 0) {
2835 if (!IN_SET(r, -ENOENT, -ENOMEDIUM, -ENOPKG)) /* If the file is missing, empty, or uninitialized, we don't mind */
2836 return log_error_errno(r, "Failed to read machine ID from container image: %m");
2837
2838 if (sd_id128_is_null(arg_uuid)) {
2839 r = sd_id128_randomize(&arg_uuid);
2840 if (r < 0)
2841 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2842 }
2843 } else {
2844 if (sd_id128_is_null(id))
2845 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2846 "Machine ID in container image is zero, refusing.");
2847
2848 arg_uuid = id;
2849 }
2850
2851 return 0;
2852 }
2853
2854 static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2855 int r;
2856
2857 assert(directory);
2858
2859 if (arg_userns_mode == USER_NAMESPACE_NO || arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_CHOWN)
2860 return 0;
2861
2862 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2863 if (r == -EOPNOTSUPP)
2864 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2865 if (r == -EBADE)
2866 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2867 if (r < 0)
2868 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2869 if (r == 0)
2870 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2871 else
2872 log_debug("Patched directory tree to match UID/GID range.");
2873
2874 return r;
2875 }
2876
2877 /*
2878 * Return values:
2879 * < 0 : wait_for_terminate() failed to get the state of the
2880 * container, the container was terminated by a signal, or
2881 * failed for an unknown reason. No change is made to the
2882 * container argument.
2883 * > 0 : The program executed in the container terminated with an
2884 * error. The exit code of the program executed in the
2885 * container is returned. The container argument has been set
2886 * to CONTAINER_TERMINATED.
2887 * 0 : The container is being rebooted, has been shut down or exited
2888 * successfully. The container argument has been set to either
2889 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
2890 *
2891 * That is, success is indicated by a return value of zero, and an
2892 * error is indicated by a non-zero value.
2893 */
2894 static int wait_for_container(pid_t pid, ContainerStatus *container) {
2895 siginfo_t status;
2896 int r;
2897
2898 r = wait_for_terminate(pid, &status);
2899 if (r < 0)
2900 return log_warning_errno(r, "Failed to wait for container: %m");
2901
2902 switch (status.si_code) {
2903
2904 case CLD_EXITED:
2905 if (status.si_status == 0)
2906 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
2907 else
2908 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
2909
2910 *container = CONTAINER_TERMINATED;
2911 return status.si_status;
2912
2913 case CLD_KILLED:
2914 if (status.si_status == SIGINT) {
2915 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
2916 *container = CONTAINER_TERMINATED;
2917 return 0;
2918
2919 } else if (status.si_status == SIGHUP) {
2920 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
2921 *container = CONTAINER_REBOOTED;
2922 return 0;
2923 }
2924
2925 _fallthrough_;
2926 case CLD_DUMPED:
2927 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2928 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
2929
2930 default:
2931 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2932 "Container %s failed due to unknown reason.", arg_machine);
2933 }
2934 }
2935
2936 static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2937 pid_t pid;
2938
2939 pid = PTR_TO_PID(userdata);
2940 if (pid > 0) {
2941 if (kill(pid, arg_kill_signal) >= 0) {
2942 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2943 sd_event_source_set_userdata(s, NULL);
2944 return 0;
2945 }
2946 }
2947
2948 sd_event_exit(sd_event_source_get_event(s), 0);
2949 return 0;
2950 }
2951
2952 static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
2953 pid_t pid;
2954
2955 assert(s);
2956 assert(ssi);
2957
2958 pid = PTR_TO_PID(userdata);
2959
2960 for (;;) {
2961 siginfo_t si = {};
2962
2963 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2964 return log_error_errno(errno, "Failed to waitid(): %m");
2965 if (si.si_pid == 0) /* No pending children. */
2966 break;
2967 if (si.si_pid == pid) {
2968 /* The main process we care for has exited. Return from
2969 * signal handler but leave the zombie. */
2970 sd_event_exit(sd_event_source_get_event(s), 0);
2971 break;
2972 }
2973
2974 /* Reap all other children. */
2975 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2976 }
2977
2978 return 0;
2979 }
2980
2981 static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2982 pid_t pid;
2983
2984 assert(m);
2985
2986 pid = PTR_TO_PID(userdata);
2987
2988 if (arg_kill_signal > 0) {
2989 log_info("Container termination requested. Attempting to halt container.");
2990 (void) kill(pid, arg_kill_signal);
2991 } else {
2992 log_info("Container termination requested. Exiting.");
2993 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
2994 }
2995
2996 return 0;
2997 }
2998
2999 static int determine_names(void) {
3000 int r;
3001
3002 if (arg_template && !arg_directory && arg_machine) {
3003
3004 /* If --template= was specified then we should not
3005 * search for a machine, but instead create a new one
3006 * in /var/lib/machine. */
3007
3008 arg_directory = path_join("/var/lib/machines", arg_machine);
3009 if (!arg_directory)
3010 return log_oom();
3011 }
3012
3013 if (!arg_image && !arg_directory) {
3014 if (arg_machine) {
3015 _cleanup_(image_unrefp) Image *i = NULL;
3016
3017 r = image_find(IMAGE_MACHINE, arg_machine, NULL, &i);
3018 if (r == -ENOENT)
3019 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
3020 if (r < 0)
3021 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
3022
3023 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
3024 r = free_and_strdup(&arg_image, i->path);
3025 else
3026 r = free_and_strdup(&arg_directory, i->path);
3027 if (r < 0)
3028 return log_oom();
3029
3030 if (!arg_ephemeral)
3031 arg_read_only = arg_read_only || i->read_only;
3032 } else {
3033 r = safe_getcwd(&arg_directory);
3034 if (r < 0)
3035 return log_error_errno(r, "Failed to determine current directory: %m");
3036 }
3037
3038 if (!arg_directory && !arg_image)
3039 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
3040 }
3041
3042 if (!arg_machine) {
3043 if (arg_directory && path_equal(arg_directory, "/"))
3044 arg_machine = gethostname_malloc();
3045 else if (arg_image) {
3046 char *e;
3047
3048 arg_machine = strdup(basename(arg_image));
3049
3050 /* Truncate suffix if there is one */
3051 e = endswith(arg_machine, ".raw");
3052 if (e)
3053 *e = 0;
3054 } else
3055 arg_machine = strdup(basename(arg_directory));
3056 if (!arg_machine)
3057 return log_oom();
3058
3059 hostname_cleanup(arg_machine);
3060 if (!hostname_is_valid(arg_machine, 0))
3061 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
3062
3063 /* Copy the machine name before the random suffix is added below, otherwise we won't be able
3064 * to match fixed config file names. */
3065 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3066 if (!arg_settings_filename)
3067 return log_oom();
3068
3069 /* Add a random suffix when this is an ephemeral machine, so that we can run many
3070 * instances at once without manually having to specify -M each time. */
3071 if (arg_ephemeral)
3072 if (strextendf(&arg_machine, "-%016" PRIx64, random_u64()) < 0)
3073 return log_oom();
3074 } else {
3075 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3076 if (!arg_settings_filename)
3077 return log_oom();
3078 }
3079
3080 return 0;
3081 }
3082
3083 static int chase_symlinks_and_update(char **p, unsigned flags) {
3084 char *chased;
3085 int r;
3086
3087 assert(p);
3088
3089 if (!*p)
3090 return 0;
3091
3092 r = chase_symlinks(*p, NULL, flags, &chased, NULL);
3093 if (r < 0)
3094 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
3095
3096 return free_and_replace(*p, chased);
3097 }
3098
3099 static int determine_uid_shift(const char *directory) {
3100
3101 if (arg_userns_mode == USER_NAMESPACE_NO) {
3102 arg_uid_shift = 0;
3103 return 0;
3104 }
3105
3106 if (arg_uid_shift == UID_INVALID) {
3107 struct stat st;
3108
3109 /* Read the UID shift off the image. Maybe we can reuse this to avoid chowning. */
3110
3111 if (stat(directory, &st) < 0)
3112 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
3113
3114 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
3115
3116 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
3117 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3118 "UID and GID base of %s don't match.", directory);
3119
3120 arg_uid_range = UINT32_C(0x10000);
3121
3122 if (arg_uid_shift != 0) {
3123 /* If the image is shifted already, then we'll fall back to classic chowning, for
3124 * compatibility (and simplicity), or refuse if mapping is explicitly requested. */
3125
3126 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_AUTO) {
3127 log_debug("UID base of %s is non-zero, not using UID mapping.", directory);
3128 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3129 } else if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_MAP)
3130 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3131 "UID base of %s is not zero, UID mapping not supported.", directory);
3132 }
3133 }
3134
3135 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
3136 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID base too high for UID range.");
3137
3138 return 0;
3139 }
3140
3141 static unsigned long effective_clone_ns_flags(void) {
3142 unsigned long flags = arg_clone_ns_flags;
3143
3144 if (arg_private_network)
3145 flags |= CLONE_NEWNET;
3146 if (arg_use_cgns)
3147 flags |= CLONE_NEWCGROUP;
3148 if (arg_userns_mode != USER_NAMESPACE_NO)
3149 flags |= CLONE_NEWUSER;
3150
3151 return flags;
3152 }
3153
3154 static int patch_sysctl(void) {
3155
3156 /* This table is inspired by runc's sysctl() function */
3157 static const struct {
3158 const char *key;
3159 bool prefix;
3160 unsigned long clone_flags;
3161 } safe_sysctl[] = {
3162 { "kernel.hostname", false, CLONE_NEWUTS },
3163 { "kernel.domainname", false, CLONE_NEWUTS },
3164 { "kernel.msgmax", false, CLONE_NEWIPC },
3165 { "kernel.msgmnb", false, CLONE_NEWIPC },
3166 { "kernel.msgmni", false, CLONE_NEWIPC },
3167 { "kernel.sem", false, CLONE_NEWIPC },
3168 { "kernel.shmall", false, CLONE_NEWIPC },
3169 { "kernel.shmmax", false, CLONE_NEWIPC },
3170 { "kernel.shmmni", false, CLONE_NEWIPC },
3171 { "fs.mqueue.", true, CLONE_NEWIPC },
3172 { "net.", true, CLONE_NEWNET },
3173 };
3174
3175 unsigned long flags;
3176 int r;
3177
3178 flags = effective_clone_ns_flags();
3179
3180 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
3181 bool good = false;
3182 size_t i;
3183
3184 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
3185
3186 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
3187 continue;
3188
3189 if (safe_sysctl[i].prefix)
3190 good = startswith(*k, safe_sysctl[i].key);
3191 else
3192 good = streq(*k, safe_sysctl[i].key);
3193
3194 if (good)
3195 break;
3196 }
3197
3198 if (!good)
3199 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
3200
3201 r = sysctl_write(*k, *v);
3202 if (r < 0)
3203 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
3204 }
3205
3206 return 0;
3207 }
3208
3209 static int inner_child(
3210 Barrier *barrier,
3211 const char *directory,
3212 bool secondary,
3213 int kmsg_socket,
3214 int rtnl_socket,
3215 int master_pty_socket,
3216 FDSet *fds,
3217 char **os_release_pairs) {
3218
3219 _cleanup_free_ char *home = NULL;
3220 size_t n_env = 1;
3221 char *envp[] = {
3222 (char*) "PATH=" DEFAULT_PATH_COMPAT,
3223 NULL, /* container */
3224 NULL, /* TERM */
3225 NULL, /* HOME */
3226 NULL, /* USER */
3227 NULL, /* LOGNAME */
3228 NULL, /* container_uuid */
3229 NULL, /* LISTEN_FDS */
3230 NULL, /* LISTEN_PID */
3231 NULL, /* NOTIFY_SOCKET */
3232 NULL, /* CREDENTIALS_DIRECTORY */
3233 NULL, /* LANG */
3234 NULL
3235 };
3236 const char *exec_target;
3237 _cleanup_strv_free_ char **env_use = NULL;
3238 int r, which_failed;
3239
3240 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
3241 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
3242 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
3243 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
3244 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
3245 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
3246 * namespace.
3247 *
3248 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
3249 * unshare(). See below. */
3250
3251 assert(barrier);
3252 assert(directory);
3253 assert(kmsg_socket >= 0);
3254
3255 log_debug("Inner child is initializing.");
3256
3257 if (arg_userns_mode != USER_NAMESPACE_NO) {
3258 /* Tell the parent, that it now can write the UID map. */
3259 (void) barrier_place(barrier); /* #1 */
3260
3261 /* Wait until the parent wrote the UID map */
3262 if (!barrier_place_and_sync(barrier)) /* #2 */
3263 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
3264
3265 /* Become the new root user inside our namespace */
3266 r = reset_uid_gid();
3267 if (r < 0)
3268 return log_error_errno(r, "Couldn't become new root: %m");
3269
3270 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
3271 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
3272 * propagation, but simply create new peer groups for all our mounts). */
3273 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
3274 if (r < 0)
3275 return r;
3276 }
3277
3278 r = mount_all(NULL,
3279 arg_mount_settings | MOUNT_IN_USERNS,
3280 arg_uid_shift,
3281 arg_selinux_apifs_context);
3282 if (r < 0)
3283 return r;
3284
3285 if (!arg_network_namespace_path && arg_private_network) {
3286 r = unshare(CLONE_NEWNET);
3287 if (r < 0)
3288 return log_error_errno(errno, "Failed to unshare network namespace: %m");
3289
3290 /* Tell the parent that it can setup network interfaces. */
3291 (void) barrier_place(barrier); /* #3 */
3292 }
3293
3294 r = mount_sysfs(NULL, arg_mount_settings);
3295 if (r < 0)
3296 return r;
3297
3298 /* Wait until we are cgroup-ified, so that we
3299 * can mount the right cgroup path writable */
3300 if (!barrier_place_and_sync(barrier)) /* #4 */
3301 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3302 "Parent died too early");
3303
3304 if (arg_use_cgns) {
3305 r = unshare(CLONE_NEWCGROUP);
3306 if (r < 0)
3307 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
3308 r = mount_cgroups(
3309 "",
3310 arg_unified_cgroup_hierarchy,
3311 arg_userns_mode != USER_NAMESPACE_NO,
3312 arg_uid_shift,
3313 arg_uid_range,
3314 arg_selinux_apifs_context,
3315 true);
3316 } else
3317 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
3318 if (r < 0)
3319 return r;
3320
3321 r = setup_boot_id();
3322 if (r < 0)
3323 return r;
3324
3325 r = setup_kmsg(kmsg_socket);
3326 if (r < 0)
3327 return r;
3328 kmsg_socket = safe_close(kmsg_socket);
3329
3330 r = mount_custom(
3331 "/",
3332 arg_custom_mounts,
3333 arg_n_custom_mounts,
3334 0,
3335 0,
3336 arg_selinux_apifs_context,
3337 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
3338 if (r < 0)
3339 return r;
3340
3341 if (setsid() < 0)
3342 return log_error_errno(errno, "setsid() failed: %m");
3343
3344 if (arg_private_network)
3345 (void) loopback_setup();
3346
3347 if (arg_expose_ports) {
3348 r = expose_port_send_rtnl(rtnl_socket);
3349 if (r < 0)
3350 return r;
3351 rtnl_socket = safe_close(rtnl_socket);
3352 }
3353
3354 if (arg_console_mode != CONSOLE_PIPE) {
3355 _cleanup_close_ int master = -1;
3356 _cleanup_free_ char *console = NULL;
3357
3358 /* Allocate a pty and make it available as /dev/console. */
3359 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3360 if (master < 0)
3361 return log_error_errno(master, "Failed to allocate a pty: %m");
3362
3363 r = setup_dev_console(console);
3364 if (r < 0)
3365 return log_error_errno(r, "Failed to set up /dev/console: %m");
3366
3367 r = send_one_fd(master_pty_socket, master, 0);
3368 if (r < 0)
3369 return log_error_errno(r, "Failed to send master fd: %m");
3370 master_pty_socket = safe_close(master_pty_socket);
3371
3372 r = setup_stdio_as_dev_console();
3373 if (r < 0)
3374 return r;
3375 }
3376
3377 r = patch_sysctl();
3378 if (r < 0)
3379 return r;
3380
3381 if (arg_oom_score_adjust_set) {
3382 r = set_oom_score_adjust(arg_oom_score_adjust);
3383 if (r < 0)
3384 return log_error_errno(r, "Failed to adjust OOM score: %m");
3385 }
3386
3387 if (arg_cpu_set.set)
3388 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
3389 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3390
3391 (void) setup_hostname();
3392
3393 if (arg_personality != PERSONALITY_INVALID) {
3394 r = safe_personality(arg_personality);
3395 if (r < 0)
3396 return log_error_errno(r, "personality() failed: %m");
3397 } else if (secondary) {
3398 r = safe_personality(PER_LINUX32);
3399 if (r < 0)
3400 return log_error_errno(r, "personality() failed: %m");
3401 }
3402
3403 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3404 if (r < 0)
3405 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3406
3407 #if HAVE_SECCOMP
3408 if (arg_seccomp) {
3409
3410 if (is_seccomp_available()) {
3411
3412 r = seccomp_load(arg_seccomp);
3413 if (ERRNO_IS_SECCOMP_FATAL(r))
3414 return log_error_errno(r, "Failed to install seccomp filter: %m");
3415 if (r < 0)
3416 log_debug_errno(r, "Failed to install seccomp filter: %m");
3417 }
3418 } else
3419 #endif
3420 {
3421 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
3422 if (r < 0)
3423 return r;
3424 }
3425
3426 if (arg_suppress_sync) {
3427 #if HAVE_SECCOMP
3428 r = seccomp_suppress_sync();
3429 if (r < 0)
3430 log_debug_errno(r, "Failed to install sync() suppression seccomp filter, ignoring: %m");
3431 #else
3432 log_debug("systemd is built without SECCOMP support. Ignoring --suppress-sync= command line option and SuppressSync= setting.");
3433 #endif
3434 }
3435
3436 #if HAVE_SELINUX
3437 if (arg_selinux_context)
3438 if (setexeccon(arg_selinux_context) < 0)
3439 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3440 #endif
3441
3442 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3443 * if we need to later on. */
3444 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3445 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3446
3447 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3448 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids, arg_console_mode != CONSOLE_PIPE);
3449 else
3450 r = change_uid_gid(arg_user, arg_console_mode != CONSOLE_PIPE, &home);
3451 if (r < 0)
3452 return r;
3453
3454 r = drop_capabilities(getuid());
3455 if (r < 0)
3456 return log_error_errno(r, "Dropping capabilities failed: %m");
3457
3458 if (arg_no_new_privileges)
3459 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3460 return log_error_errno(errno, "Failed to disable new privileges: %m");
3461
3462 /* LXC sets container=lxc, so follow the scheme here */
3463 envp[n_env++] = strjoina("container=", arg_container_service_name);
3464
3465 envp[n_env] = strv_find_prefix(environ, "TERM=");
3466 if (envp[n_env])
3467 n_env++;
3468
3469 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
3470 if (asprintf(envp + n_env++, "HOME=%s", home ?: "/root") < 0)
3471 return log_oom();
3472
3473 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
3474 if (asprintf(envp + n_env++, "USER=%s", arg_user ?: "root") < 0 ||
3475 asprintf(envp + n_env++, "LOGNAME=%s", arg_user ? arg_user : "root") < 0)
3476 return log_oom();
3477
3478 assert(!sd_id128_is_null(arg_uuid));
3479
3480 if (asprintf(envp + n_env++, "container_uuid=%s", SD_ID128_TO_UUID_STRING(arg_uuid)) < 0)
3481 return log_oom();
3482
3483 if (fdset_size(fds) > 0) {
3484 r = fdset_cloexec(fds, false);
3485 if (r < 0)
3486 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3487
3488 if ((asprintf(envp + n_env++, "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3489 (asprintf(envp + n_env++, "LISTEN_PID=1") < 0))
3490 return log_oom();
3491 }
3492 if (asprintf(envp + n_env++, "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
3493 return log_oom();
3494
3495 if (arg_n_credentials > 0) {
3496 envp[n_env] = strdup("CREDENTIALS_DIRECTORY=/run/host/credentials");
3497 if (!envp[n_env])
3498 return log_oom();
3499 n_env++;
3500 }
3501
3502 if (arg_start_mode != START_BOOT) {
3503 envp[n_env] = strdup("LANG=" SYSTEMD_NSPAWN_LOCALE);
3504 if (!envp[n_env])
3505 return log_oom();
3506 n_env++;
3507 }
3508
3509 env_use = strv_env_merge(envp, os_release_pairs, arg_setenv);
3510 if (!env_use)
3511 return log_oom();
3512
3513 /* Let the parent know that we are ready and
3514 * wait until the parent is ready with the
3515 * setup, too... */
3516 if (!barrier_place_and_sync(barrier)) /* #5 */
3517 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
3518
3519 if (arg_chdir)
3520 if (chdir(arg_chdir) < 0)
3521 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3522
3523 if (arg_start_mode == START_PID2) {
3524 r = stub_pid1(arg_uuid);
3525 if (r < 0)
3526 return r;
3527 }
3528
3529 if (arg_console_mode != CONSOLE_PIPE) {
3530 /* So far our pty wasn't controlled by any process. Finally, it's time to change that, if we
3531 * are configured for that. Acquire it as controlling tty. */
3532 if (ioctl(STDIN_FILENO, TIOCSCTTY) < 0)
3533 return log_error_errno(errno, "Failed to acquire controlling TTY: %m");
3534 }
3535
3536 log_debug("Inner child completed, invoking payload.");
3537
3538 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3539 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3540 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
3541 log_close();
3542 log_set_open_when_needed(true);
3543
3544 (void) fdset_close_others(fds);
3545
3546 if (arg_start_mode == START_BOOT) {
3547 char **a;
3548 size_t m;
3549
3550 /* Automatically search for the init system */
3551
3552 m = strv_length(arg_parameters);
3553 a = newa(char*, m + 2);
3554 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3555 a[1 + m] = NULL;
3556
3557 FOREACH_STRING(init,
3558 "/usr/lib/systemd/systemd",
3559 "/lib/systemd/systemd",
3560 "/sbin/init") {
3561 a[0] = (char*) init;
3562 execve(a[0], a, env_use);
3563 }
3564
3565 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
3566 } else if (!strv_isempty(arg_parameters)) {
3567 const char *dollar_path;
3568
3569 exec_target = arg_parameters[0];
3570
3571 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3572 * binary. */
3573 dollar_path = strv_env_get(env_use, "PATH");
3574 if (dollar_path) {
3575 if (setenv("PATH", dollar_path, 1) < 0)
3576 return log_error_errno(errno, "Failed to update $PATH: %m");
3577 }
3578
3579 execvpe(arg_parameters[0], arg_parameters, env_use);
3580 } else {
3581 if (!arg_chdir)
3582 /* If we cannot change the directory, we'll end up in /, that is expected. */
3583 (void) chdir(home ?: "/root");
3584
3585 execle(DEFAULT_USER_SHELL, "-" DEFAULT_USER_SHELL_NAME, NULL, env_use);
3586 if (!streq(DEFAULT_USER_SHELL, "/bin/bash"))
3587 execle("/bin/bash", "-bash", NULL, env_use);
3588 if (!streq(DEFAULT_USER_SHELL, "/bin/sh"))
3589 execle("/bin/sh", "-sh", NULL, env_use);
3590
3591 exec_target = DEFAULT_USER_SHELL ", /bin/bash, /bin/sh";
3592 }
3593
3594 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
3595 }
3596
3597 static int setup_notify_child(void) {
3598 _cleanup_close_ int fd = -1;
3599 static const union sockaddr_union sa = {
3600 .un.sun_family = AF_UNIX,
3601 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
3602 };
3603 int r;
3604
3605 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3606 if (fd < 0)
3607 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3608
3609 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
3610 (void) sockaddr_un_unlink(&sa.un);
3611
3612 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
3613 if (r < 0)
3614 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
3615
3616 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
3617 if (r < 0)
3618 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
3619
3620 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
3621 if (r < 0)
3622 return log_error_errno(r, "SO_PASSCRED failed: %m");
3623
3624 return TAKE_FD(fd);
3625 }
3626
3627 static int outer_child(
3628 Barrier *barrier,
3629 const char *directory,
3630 DissectedImage *dissected_image,
3631 bool secondary,
3632 int pid_socket,
3633 int uuid_socket,
3634 int notify_socket,
3635 int kmsg_socket,
3636 int rtnl_socket,
3637 int uid_shift_socket,
3638 int master_pty_socket,
3639 int unified_cgroup_hierarchy_socket,
3640 FDSet *fds,
3641 int netns_fd) {
3642
3643 _cleanup_(bind_user_context_freep) BindUserContext *bind_user_context = NULL;
3644 _cleanup_strv_free_ char **os_release_pairs = NULL;
3645 _cleanup_close_ int fd = -1, mntns_fd = -EBADF;
3646 bool idmap = false;
3647 const char *p;
3648 pid_t pid;
3649 ssize_t l;
3650 int r;
3651
3652 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It
3653 * already has its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in
3654 * the host's CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET
3655 * namespaces. After it completed a number of initializations a second child (the "inner" one) is
3656 * forked off it, and it exits. */
3657
3658 assert(barrier);
3659 assert(directory);
3660 assert(pid_socket >= 0);
3661 assert(uuid_socket >= 0);
3662 assert(notify_socket >= 0);
3663 assert(master_pty_socket >= 0);
3664 assert(kmsg_socket >= 0);
3665
3666 log_debug("Outer child is initializing.");
3667
3668 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3669 if (r < 0)
3670 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3671
3672 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3673 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3674
3675 r = reset_audit_loginuid();
3676 if (r < 0)
3677 return r;
3678
3679 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3680 * mounts to the real root. */
3681 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
3682 if (r < 0)
3683 return r;
3684
3685 if (dissected_image) {
3686 /* If we are operating on a disk image, then mount its root directory now, but leave out the
3687 * rest. We can read the UID shift from it if we need to. Further down we'll mount the rest,
3688 * but then with the uid shift known. That way we can mount VFAT file systems shifted to the
3689 * right place right away. This makes sure ESP partitions and userns are compatible. */
3690
3691 r = dissected_image_mount_and_warn(
3692 dissected_image,
3693 directory,
3694 arg_uid_shift,
3695 arg_uid_range,
3696 DISSECT_IMAGE_MOUNT_ROOT_ONLY|
3697 DISSECT_IMAGE_DISCARD_ON_LOOP|
3698 DISSECT_IMAGE_USR_NO_ROOT|
3699 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3700 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
3701 if (r < 0)
3702 return r;
3703 }
3704
3705 r = determine_uid_shift(directory);
3706 if (r < 0)
3707 return r;
3708
3709 if (arg_userns_mode != USER_NAMESPACE_NO) {
3710 r = namespace_open(0, NULL, &mntns_fd, NULL, NULL, NULL);
3711 if (r < 0)
3712 return log_error_errno(r, "Failed to pin outer mount namespace: %m");
3713
3714 l = send_one_fd(notify_socket, mntns_fd, 0);
3715 if (l < 0)
3716 return log_error_errno(l, "Failed to send outer mount namespace fd: %m");
3717 mntns_fd = safe_close(mntns_fd);
3718
3719 /* Let the parent know which UID shift we read from the image */
3720 l = send(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
3721 if (l < 0)
3722 return log_error_errno(errno, "Failed to send UID shift: %m");
3723 if (l != sizeof(arg_uid_shift))
3724 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3725 "Short write while sending UID shift.");
3726
3727 if (arg_userns_mode == USER_NAMESPACE_PICK) {
3728 /* When we are supposed to pick the UID shift, the parent will check now whether the
3729 * UID shift we just read from the image is available. If yes, it will send the UID
3730 * shift back to us, if not it will pick a different one, and send it back to us. */
3731
3732 l = recv(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
3733 if (l < 0)
3734 return log_error_errno(errno, "Failed to recv UID shift: %m");
3735 if (l != sizeof(arg_uid_shift))
3736 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3737 "Short read while receiving UID shift.");
3738 }
3739
3740 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3741 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
3742 }
3743
3744 if (path_equal(directory, "/")) {
3745 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3746 * place, so that we can make changes to its mount structure (for example, to implement
3747 * --volatile=) without this interfering with our ability to access files such as
3748 * /etc/localtime to copy into the container. Note that we use a fixed place for this
3749 * (instead of a temporary directory, since we are living in our own mount namespace here
3750 * already, and thus don't need to be afraid of colliding with anyone else's mounts). */
3751 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3752
3753 r = mount_nofollow_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
3754 if (r < 0)
3755 return r;
3756
3757 directory = "/run/systemd/nspawn-root";
3758 }
3759
3760 r = setup_pivot_root(
3761 directory,
3762 arg_pivot_root_new,
3763 arg_pivot_root_old);
3764 if (r < 0)
3765 return r;
3766
3767 r = setup_volatile_mode(
3768 directory,
3769 arg_volatile_mode,
3770 arg_uid_shift,
3771 arg_selinux_apifs_context);
3772 if (r < 0)
3773 return r;
3774
3775 r = bind_user_prepare(
3776 directory,
3777 arg_bind_user,
3778 arg_uid_shift,
3779 arg_uid_range,
3780 &arg_custom_mounts, &arg_n_custom_mounts,
3781 &bind_user_context);
3782 if (r < 0)
3783 return r;
3784
3785 if (arg_userns_mode != USER_NAMESPACE_NO && bind_user_context) {
3786 /* Send the user maps we determined to the parent, so that it installs it in our user
3787 * namespace UID map table */
3788
3789 for (size_t i = 0; i < bind_user_context->n_data; i++) {
3790 uid_t map[] = {
3791 bind_user_context->data[i].payload_user->uid,
3792 bind_user_context->data[i].host_user->uid,
3793 (uid_t) bind_user_context->data[i].payload_group->gid,
3794 (uid_t) bind_user_context->data[i].host_group->gid,
3795 };
3796
3797 l = send(uid_shift_socket, map, sizeof(map), MSG_NOSIGNAL);
3798 if (l < 0)
3799 return log_error_errno(errno, "Failed to send user UID map: %m");
3800 if (l != sizeof(map))
3801 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3802 "Short write while sending user UID map.");
3803 }
3804 }
3805
3806 r = mount_custom(
3807 directory,
3808 arg_custom_mounts,
3809 arg_n_custom_mounts,
3810 arg_uid_shift,
3811 arg_uid_range,
3812 arg_selinux_apifs_context,
3813 MOUNT_ROOT_ONLY);
3814 if (r < 0)
3815 return r;
3816
3817 /* Make sure we always have a mount that we can move to root later on. */
3818 r = make_mount_point(directory);
3819 if (r < 0)
3820 return r;
3821
3822 if (arg_userns_mode != USER_NAMESPACE_NO &&
3823 IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
3824 arg_uid_shift != 0) {
3825
3826 r = remount_idmap(directory, arg_uid_shift, arg_uid_range, UID_INVALID, REMOUNT_IDMAPPING_HOST_ROOT);
3827 if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) {
3828 /* This might fail because the kernel or file system doesn't support idmapping. We
3829 * can't really distinguish this nicely, nor do we have any guarantees about the
3830 * error codes we see, could be EOPNOTSUPP or EINVAL. */
3831 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_AUTO)
3832 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3833 "ID mapped mounts are apparently not available, sorry.");
3834
3835 log_debug("ID mapped mounts are apparently not available on this kernel or for the selected file system, reverting to recursive chown()ing.");
3836 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3837 } else if (r < 0)
3838 return log_error_errno(r, "Failed to set up ID mapped mounts: %m");
3839 else {
3840 log_debug("ID mapped mounts available, making use of them.");
3841 idmap = true;
3842 }
3843 }
3844
3845 if (dissected_image) {
3846 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
3847 r = dissected_image_mount(
3848 dissected_image,
3849 directory,
3850 arg_uid_shift,
3851 arg_uid_range,
3852 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|
3853 DISSECT_IMAGE_DISCARD_ON_LOOP|
3854 DISSECT_IMAGE_USR_NO_ROOT|
3855 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3856 (idmap ? DISSECT_IMAGE_MOUNT_IDMAPPED : 0));
3857 if (r == -EUCLEAN)
3858 return log_error_errno(r, "File system check for image failed: %m");
3859 if (r < 0)
3860 return log_error_errno(r, "Failed to mount image file system: %m");
3861 }
3862
3863 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3864 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3865
3866 r = detect_unified_cgroup_hierarchy_from_image(directory);
3867 if (r < 0)
3868 return r;
3869
3870 l = send(unified_cgroup_hierarchy_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
3871 if (l < 0)
3872 return log_error_errno(errno, "Failed to send cgroup mode: %m");
3873 if (l != sizeof(arg_unified_cgroup_hierarchy))
3874 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3875 "Short write while sending cgroup mode.");
3876
3877 unified_cgroup_hierarchy_socket = safe_close(unified_cgroup_hierarchy_socket);
3878 }
3879
3880 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3881 if (r < 0)
3882 return r;
3883
3884 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3885 if (r < 0)
3886 return r;
3887
3888 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3889 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
3890 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
3891 if (r < 0)
3892 return log_error_errno(r, "Failed to make tree read-only: %m");
3893 }
3894
3895 r = mount_all(directory,
3896 arg_mount_settings,
3897 arg_uid_shift,
3898 arg_selinux_apifs_context);
3899 if (r < 0)
3900 return r;
3901
3902 r = copy_devnodes(directory);
3903 if (r < 0)
3904 return r;
3905
3906 r = make_extra_nodes(directory);
3907 if (r < 0)
3908 return r;
3909
3910 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
3911
3912 p = prefix_roota(directory, "/run/host");
3913 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
3914
3915 r = setup_pts(directory);
3916 if (r < 0)
3917 return r;
3918
3919 r = mount_tunnel_dig(directory);
3920 if (r < 0)
3921 return r;
3922
3923 r = setup_keyring();
3924 if (r < 0)
3925 return r;
3926
3927 r = setup_credentials(directory);
3928 if (r < 0)
3929 return r;
3930
3931 r = bind_user_setup(bind_user_context, directory);
3932 if (r < 0)
3933 return r;
3934
3935 r = mount_custom(
3936 directory,
3937 arg_custom_mounts,
3938 arg_n_custom_mounts,
3939 arg_uid_shift,
3940 arg_uid_range,
3941 arg_selinux_apifs_context,
3942 MOUNT_NON_ROOT_ONLY);
3943 if (r < 0)
3944 return r;
3945
3946 r = setup_timezone(directory);
3947 if (r < 0)
3948 return r;
3949
3950 r = setup_resolv_conf(directory);
3951 if (r < 0)
3952 return r;
3953
3954 r = setup_machine_id(directory);
3955 if (r < 0)
3956 return r;
3957
3958 r = setup_journal(directory);
3959 if (r < 0)
3960 return r;
3961
3962 /* The same stuff as the $container env var, but nicely readable for the entire payload */
3963 p = prefix_roota(directory, "/run/host/container-manager");
3964 (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE);
3965
3966 /* The same stuff as the $container_uuid env var */
3967 p = prefix_roota(directory, "/run/host/container-uuid");
3968 (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
3969
3970 if (!arg_use_cgns) {
3971 r = mount_cgroups(
3972 directory,
3973 arg_unified_cgroup_hierarchy,
3974 arg_userns_mode != USER_NAMESPACE_NO,
3975 arg_uid_shift,
3976 arg_uid_range,
3977 arg_selinux_apifs_context,
3978 false);
3979 if (r < 0)
3980 return r;
3981 }
3982
3983 /* Mark everything as shared so our mounts get propagated down. This is required to make new bind
3984 * mounts available in systemd services inside the container that create a new mount namespace. See
3985 * https://github.com/systemd/systemd/issues/3860 Further submounts (such as /dev) done after this
3986 * will inherit the shared propagation mode.
3987 *
3988 * IMPORTANT: Do not overmount the root directory anymore from now on to enable moving the root
3989 * directory mount to root later on.
3990 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3991 */
3992 r = mount_switch_root(directory, MOUNT_ATTR_PROPAGATION_SHARED);
3993 if (r < 0)
3994 return log_error_errno(r, "Failed to move root directory: %m");
3995
3996 /* We finished setting up the rootfs which is a shared mount. The mount tunnel needs to be a
3997 * dependent mount otherwise we can't MS_MOVE mounts that were propagated from the host into
3998 * the container. */
3999 r = mount_tunnel_open();
4000 if (r < 0)
4001 return r;
4002
4003 if (arg_userns_mode != USER_NAMESPACE_NO) {
4004 /* In order to mount procfs and sysfs in an unprivileged container the kernel
4005 * requires that a fully visible instance is already present in the target mount
4006 * namespace. Mount one here so the inner child can mount its own instances. Later
4007 * we umount the temporary instances created here before we actually exec the
4008 * payload. Since the rootfs is shared the umount will propagate into the container.
4009 * Note, the inner child wouldn't be able to unmount the instances on its own since
4010 * it doesn't own the originating mount namespace. IOW, the outer child needs to do
4011 * this. */
4012 r = pin_fully_visible_fs();
4013 if (r < 0)
4014 return r;
4015 }
4016
4017 fd = setup_notify_child();
4018 if (fd < 0)
4019 return fd;
4020
4021 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
4022 arg_clone_ns_flags |
4023 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
4024 if (pid < 0)
4025 return log_error_errno(errno, "Failed to fork inner child: %m");
4026 if (pid == 0) {
4027 pid_socket = safe_close(pid_socket);
4028 uuid_socket = safe_close(uuid_socket);
4029 notify_socket = safe_close(notify_socket);
4030 uid_shift_socket = safe_close(uid_shift_socket);
4031
4032 /* The inner child has all namespaces that are requested, so that we all are owned by the
4033 * user if user namespaces are turned on. */
4034
4035 if (arg_network_namespace_path) {
4036 r = namespace_enter(-1, -1, netns_fd, -1, -1);
4037 if (r < 0)
4038 return log_error_errno(r, "Failed to join network namespace: %m");
4039 }
4040
4041 r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, master_pty_socket, fds, os_release_pairs);
4042 if (r < 0)
4043 _exit(EXIT_FAILURE);
4044
4045 _exit(EXIT_SUCCESS);
4046 }
4047
4048 l = send(pid_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
4049 if (l < 0)
4050 return log_error_errno(errno, "Failed to send PID: %m");
4051 if (l != sizeof(pid))
4052 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4053 "Short write while sending PID.");
4054
4055 l = send(uuid_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
4056 if (l < 0)
4057 return log_error_errno(errno, "Failed to send machine ID: %m");
4058 if (l != sizeof(arg_uuid))
4059 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4060 "Short write while sending machine ID.");
4061
4062 l = send_one_fd(notify_socket, fd, 0);
4063 if (l < 0)
4064 return log_error_errno(l, "Failed to send notify fd: %m");
4065
4066 pid_socket = safe_close(pid_socket);
4067 uuid_socket = safe_close(uuid_socket);
4068 notify_socket = safe_close(notify_socket);
4069 master_pty_socket = safe_close(master_pty_socket);
4070 kmsg_socket = safe_close(kmsg_socket);
4071 rtnl_socket = safe_close(rtnl_socket);
4072 netns_fd = safe_close(netns_fd);
4073
4074 return 0;
4075 }
4076
4077 static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
4078 bool tried_hashed = false;
4079 unsigned n_tries = 100;
4080 uid_t candidate;
4081 int r;
4082
4083 assert(shift);
4084 assert(ret_lock_file);
4085 assert(arg_userns_mode == USER_NAMESPACE_PICK);
4086 assert(arg_uid_range == 0x10000U);
4087
4088 candidate = *shift;
4089
4090 (void) mkdir("/run/systemd/nspawn-uid", 0755);
4091
4092 for (;;) {
4093 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
4094 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
4095
4096 if (--n_tries <= 0)
4097 return -EBUSY;
4098
4099 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
4100 goto next;
4101 if ((candidate & UINT32_C(0xFFFF)) != 0)
4102 goto next;
4103
4104 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
4105 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
4106 if (r == -EBUSY) /* Range already taken by another nspawn instance */
4107 goto next;
4108 if (r < 0)
4109 return r;
4110
4111 /* Make some superficial checks whether the range is currently known in the user database */
4112 if (getpwuid(candidate))
4113 goto next;
4114 if (getpwuid(candidate + UINT32_C(0xFFFE)))
4115 goto next;
4116 if (getgrgid(candidate))
4117 goto next;
4118 if (getgrgid(candidate + UINT32_C(0xFFFE)))
4119 goto next;
4120
4121 *ret_lock_file = lf;
4122 lf = (struct LockFile) LOCK_FILE_INIT;
4123 *shift = candidate;
4124 return 0;
4125
4126 next:
4127 if (arg_machine && !tried_hashed) {
4128 /* Try to hash the base from the container name */
4129
4130 static const uint8_t hash_key[] = {
4131 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
4132 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
4133 };
4134
4135 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
4136
4137 tried_hashed = true;
4138 } else
4139 random_bytes(&candidate, sizeof(candidate));
4140
4141 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
4142 candidate &= (uid_t) UINT32_C(0xFFFF0000);
4143 }
4144 }
4145
4146 static int add_one_uid_map(
4147 char **p,
4148 uid_t container_uid,
4149 uid_t host_uid,
4150 uid_t range) {
4151
4152 return strextendf(p,
4153 UID_FMT " " UID_FMT " " UID_FMT "\n",
4154 container_uid, host_uid, range);
4155 }
4156
4157 static int make_uid_map_string(
4158 const uid_t bind_user_uid[],
4159 size_t n_bind_user_uid,
4160 size_t offset,
4161 char **ret) {
4162
4163 _cleanup_free_ char *s = NULL;
4164 uid_t previous_uid = 0;
4165 int r;
4166
4167 assert(n_bind_user_uid == 0 || bind_user_uid);
4168 assert(IN_SET(offset, 0, 2)); /* used to switch between UID and GID map */
4169 assert(ret);
4170
4171 /* The bind_user_uid[] array is a series of 4 uid_t values, for each --bind-user= entry one
4172 * quadruplet, consisting of host and container UID + GID. */
4173
4174 for (size_t i = 0; i < n_bind_user_uid; i++) {
4175 uid_t payload_uid = bind_user_uid[i*4+offset],
4176 host_uid = bind_user_uid[i*4+offset+1];
4177
4178 assert(previous_uid <= payload_uid);
4179 assert(payload_uid < arg_uid_range);
4180
4181 /* Add a range to close the gap to previous entry */
4182 if (payload_uid > previous_uid) {
4183 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, payload_uid - previous_uid);
4184 if (r < 0)
4185 return r;
4186 }
4187
4188 /* Map this specific user */
4189 r = add_one_uid_map(&s, payload_uid, host_uid, 1);
4190 if (r < 0)
4191 return r;
4192
4193 previous_uid = payload_uid + 1;
4194 }
4195
4196 /* And add a range to close the gap to finish the range */
4197 if (arg_uid_range > previous_uid) {
4198 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, arg_uid_range - previous_uid);
4199 if (r < 0)
4200 return r;
4201 }
4202
4203 assert(s);
4204
4205 *ret = TAKE_PTR(s);
4206 return 0;
4207 }
4208
4209 static int setup_uid_map(
4210 pid_t pid,
4211 const uid_t bind_user_uid[],
4212 size_t n_bind_user_uid) {
4213
4214 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1];
4215 _cleanup_free_ char *s = NULL;
4216 int r;
4217
4218 assert(pid > 1);
4219
4220 /* Build the UID map string */
4221 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 0, &s) < 0) /* offset=0 contains the UID pair */
4222 return log_oom();
4223
4224 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
4225 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
4226 if (r < 0)
4227 return log_error_errno(r, "Failed to write UID map: %m");
4228
4229 /* And now build the GID map string */
4230 s = mfree(s);
4231 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 2, &s) < 0) /* offset=2 contains the GID pair */
4232 return log_oom();
4233
4234 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
4235 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
4236 if (r < 0)
4237 return log_error_errno(r, "Failed to write GID map: %m");
4238
4239 return 0;
4240 }
4241
4242 static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
4243 char buf[NOTIFY_BUFFER_MAX+1];
4244 char *p = NULL;
4245 struct iovec iovec = {
4246 .iov_base = buf,
4247 .iov_len = sizeof(buf)-1,
4248 };
4249 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
4250 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
4251 struct msghdr msghdr = {
4252 .msg_iov = &iovec,
4253 .msg_iovlen = 1,
4254 .msg_control = &control,
4255 .msg_controllen = sizeof(control),
4256 };
4257 struct ucred *ucred;
4258 ssize_t n;
4259 pid_t inner_child_pid;
4260 _cleanup_strv_free_ char **tags = NULL;
4261 int r;
4262
4263 assert(userdata);
4264
4265 inner_child_pid = PTR_TO_PID(userdata);
4266
4267 if (revents != EPOLLIN) {
4268 log_warning("Got unexpected poll event for notify fd.");
4269 return 0;
4270 }
4271
4272 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
4273 if (n < 0) {
4274 if (ERRNO_IS_TRANSIENT(n))
4275 return 0;
4276 if (n == -EXFULL) {
4277 log_warning("Got message with truncated control data (too many fds sent?), ignoring.");
4278 return 0;
4279 }
4280 return log_warning_errno(n, "Couldn't read notification socket: %m");
4281 }
4282
4283 cmsg_close_all(&msghdr);
4284
4285 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
4286 if (!ucred || ucred->pid != inner_child_pid) {
4287 log_debug("Received notify message without valid credentials. Ignoring.");
4288 return 0;
4289 }
4290
4291 if ((size_t) n >= sizeof(buf)) {
4292 log_warning("Received notify message exceeded maximum size. Ignoring.");
4293 return 0;
4294 }
4295
4296 buf[n] = 0;
4297 tags = strv_split(buf, "\n\r");
4298 if (!tags)
4299 return log_oom();
4300
4301 if (strv_contains(tags, "READY=1")) {
4302 r = sd_notify(false, "READY=1\n");
4303 if (r < 0)
4304 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
4305 }
4306
4307 p = strv_find_startswith(tags, "STATUS=");
4308 if (p)
4309 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
4310
4311 return 0;
4312 }
4313
4314 static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
4315 int r;
4316
4317 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
4318 if (r < 0)
4319 return log_error_errno(r, "Failed to allocate notify event source: %m");
4320
4321 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
4322
4323 return 0;
4324 }
4325
4326 static int merge_settings(Settings *settings, const char *path) {
4327 int rl;
4328
4329 assert(settings);
4330 assert(path);
4331
4332 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
4333 * that this steals the fields of the Settings* structure, and hence modifies it. */
4334
4335 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
4336 settings->start_mode >= 0) {
4337 arg_start_mode = settings->start_mode;
4338 strv_free_and_replace(arg_parameters, settings->parameters);
4339 }
4340
4341 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
4342 settings->ephemeral >= 0)
4343 arg_ephemeral = settings->ephemeral;
4344
4345 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
4346 settings->root) {
4347
4348 if (!arg_settings_trusted)
4349 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
4350 else
4351 free_and_replace(arg_directory, settings->root);
4352 }
4353
4354 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
4355 settings->pivot_root_new) {
4356 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
4357 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
4358 }
4359
4360 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
4361 settings->working_directory)
4362 free_and_replace(arg_chdir, settings->working_directory);
4363
4364 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
4365 settings->environment)
4366 strv_free_and_replace(arg_setenv, settings->environment);
4367
4368 if ((arg_settings_mask & SETTING_USER) == 0) {
4369
4370 if (settings->user)
4371 free_and_replace(arg_user, settings->user);
4372
4373 if (uid_is_valid(settings->uid))
4374 arg_uid = settings->uid;
4375 if (gid_is_valid(settings->gid))
4376 arg_gid = settings->gid;
4377 if (settings->n_supplementary_gids > 0) {
4378 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
4379 arg_n_supplementary_gids = settings->n_supplementary_gids;
4380 }
4381 }
4382
4383 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
4384 uint64_t plus, minus;
4385 uint64_t network_minus = 0;
4386 uint64_t ambient;
4387
4388 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
4389 * Settings structure */
4390
4391 plus = settings->capability;
4392 minus = settings->drop_capability;
4393
4394 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4395 settings_network_configured(settings)) {
4396 if (settings_private_network(settings))
4397 plus |= UINT64_C(1) << CAP_NET_ADMIN;
4398 else
4399 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
4400 }
4401
4402 if (!arg_settings_trusted && plus != 0) {
4403 if (settings->capability != 0)
4404 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
4405 } else {
4406 arg_caps_retain &= ~network_minus;
4407 arg_caps_retain |= plus;
4408 }
4409
4410 arg_caps_retain &= ~minus;
4411
4412 /* Copy the full capabilities over too */
4413 if (capability_quintet_is_set(&settings->full_capabilities)) {
4414 if (!arg_settings_trusted)
4415 log_warning("Ignoring capability settings, file %s is not trusted.", path);
4416 else
4417 arg_full_capabilities = settings->full_capabilities;
4418 }
4419
4420 ambient = settings->ambient_capability;
4421 if (!arg_settings_trusted && ambient != 0)
4422 log_warning("Ignoring AmbientCapability= setting, file %s is not trusted.", path);
4423 else
4424 arg_caps_ambient |= ambient;
4425 }
4426
4427 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
4428 settings->kill_signal > 0)
4429 arg_kill_signal = settings->kill_signal;
4430
4431 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
4432 settings->personality != PERSONALITY_INVALID)
4433 arg_personality = settings->personality;
4434
4435 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
4436 !sd_id128_is_null(settings->machine_id)) {
4437
4438 if (!arg_settings_trusted)
4439 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
4440 else
4441 arg_uuid = settings->machine_id;
4442 }
4443
4444 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
4445 settings->read_only >= 0)
4446 arg_read_only = settings->read_only;
4447
4448 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
4449 settings->volatile_mode != _VOLATILE_MODE_INVALID)
4450 arg_volatile_mode = settings->volatile_mode;
4451
4452 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
4453 settings->n_custom_mounts > 0) {
4454
4455 if (!arg_settings_trusted)
4456 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
4457 else {
4458 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
4459 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
4460 arg_n_custom_mounts = settings->n_custom_mounts;
4461 settings->n_custom_mounts = 0;
4462 }
4463 }
4464
4465 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4466 settings_network_configured(settings)) {
4467
4468 if (!arg_settings_trusted)
4469 log_warning("Ignoring network settings, file %s is not trusted.", path);
4470 else {
4471 arg_network_veth = settings_network_veth(settings);
4472 arg_private_network = settings_private_network(settings);
4473
4474 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
4475 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
4476 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
4477 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
4478
4479 free_and_replace(arg_network_bridge, settings->network_bridge);
4480 free_and_replace(arg_network_zone, settings->network_zone);
4481
4482 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
4483 }
4484 }
4485
4486 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
4487 settings->expose_ports) {
4488
4489 if (!arg_settings_trusted)
4490 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
4491 else {
4492 expose_port_free_all(arg_expose_ports);
4493 arg_expose_ports = TAKE_PTR(settings->expose_ports);
4494 }
4495 }
4496
4497 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
4498 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
4499
4500 if (!arg_settings_trusted)
4501 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
4502 else {
4503 arg_userns_mode = settings->userns_mode;
4504 arg_uid_shift = settings->uid_shift;
4505 arg_uid_range = settings->uid_range;
4506 arg_userns_ownership = settings->userns_ownership;
4507 }
4508 }
4509
4510 if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
4511 !strv_isempty(settings->bind_user))
4512 strv_free_and_replace(arg_bind_user, settings->bind_user);
4513
4514 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
4515 settings->notify_ready >= 0)
4516 arg_notify_ready = settings->notify_ready;
4517
4518 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
4519
4520 if (!strv_isempty(settings->syscall_allow_list) || !strv_isempty(settings->syscall_deny_list)) {
4521 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
4522 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
4523 else {
4524 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4525 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
4526 }
4527 }
4528
4529 #if HAVE_SECCOMP
4530 if (settings->seccomp) {
4531 if (!arg_settings_trusted)
4532 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4533 else {
4534 seccomp_release(arg_seccomp);
4535 arg_seccomp = TAKE_PTR(settings->seccomp);
4536 }
4537 }
4538 #endif
4539 }
4540
4541 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4542 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4543 continue;
4544
4545 if (!settings->rlimit[rl])
4546 continue;
4547
4548 if (!arg_settings_trusted) {
4549 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
4550 continue;
4551 }
4552
4553 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4554 }
4555
4556 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4557 settings->hostname)
4558 free_and_replace(arg_hostname, settings->hostname);
4559
4560 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4561 settings->no_new_privileges >= 0)
4562 arg_no_new_privileges = settings->no_new_privileges;
4563
4564 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4565 settings->oom_score_adjust_set) {
4566
4567 if (!arg_settings_trusted)
4568 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
4569 else {
4570 arg_oom_score_adjust = settings->oom_score_adjust;
4571 arg_oom_score_adjust_set = true;
4572 }
4573 }
4574
4575 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
4576 settings->cpu_set.set) {
4577
4578 if (!arg_settings_trusted)
4579 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
4580 else {
4581 cpu_set_reset(&arg_cpu_set);
4582 arg_cpu_set = settings->cpu_set;
4583 settings->cpu_set = (CPUSet) {};
4584 }
4585 }
4586
4587 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4588 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4589 arg_resolv_conf = settings->resolv_conf;
4590
4591 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4592 settings->link_journal != _LINK_JOURNAL_INVALID) {
4593
4594 if (!arg_settings_trusted)
4595 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4596 else {
4597 arg_link_journal = settings->link_journal;
4598 arg_link_journal_try = settings->link_journal_try;
4599 }
4600 }
4601
4602 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4603 settings->timezone != _TIMEZONE_MODE_INVALID)
4604 arg_timezone = settings->timezone;
4605
4606 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4607 settings->slice) {
4608
4609 if (!arg_settings_trusted)
4610 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4611 else
4612 free_and_replace(arg_slice, settings->slice);
4613 }
4614
4615 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4616 settings->use_cgns >= 0) {
4617
4618 if (!arg_settings_trusted)
4619 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4620 else
4621 arg_use_cgns = settings->use_cgns;
4622 }
4623
4624 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
4625 settings->clone_ns_flags != ULONG_MAX) {
4626
4627 if (!arg_settings_trusted)
4628 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4629 else
4630 arg_clone_ns_flags = settings->clone_ns_flags;
4631 }
4632
4633 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4634 settings->console_mode >= 0) {
4635
4636 if (!arg_settings_trusted)
4637 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4638 else
4639 arg_console_mode = settings->console_mode;
4640 }
4641
4642 if ((arg_settings_mask & SETTING_SUPPRESS_SYNC) == 0 &&
4643 settings->suppress_sync >= 0)
4644 arg_suppress_sync = settings->suppress_sync;
4645
4646 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4647 * don't consult arg_settings_mask for them. */
4648
4649 sd_bus_message_unref(arg_property_message);
4650 arg_property_message = TAKE_PTR(settings->properties);
4651
4652 arg_console_width = settings->console_width;
4653 arg_console_height = settings->console_height;
4654
4655 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
4656 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4657 arg_n_extra_nodes = settings->n_extra_nodes;
4658
4659 return 0;
4660 }
4661
4662 static int load_settings(void) {
4663 _cleanup_(settings_freep) Settings *settings = NULL;
4664 _cleanup_fclose_ FILE *f = NULL;
4665 _cleanup_free_ char *p = NULL;
4666 int r;
4667
4668 if (arg_oci_bundle)
4669 return 0;
4670
4671 /* If all settings are masked, there's no point in looking for
4672 * the settings file */
4673 if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
4674 return 0;
4675
4676 /* We first look in the admin's directories in /etc and /run */
4677 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4678 _cleanup_free_ char *j = NULL;
4679
4680 j = path_join(i, arg_settings_filename);
4681 if (!j)
4682 return log_oom();
4683
4684 f = fopen(j, "re");
4685 if (f) {
4686 p = TAKE_PTR(j);
4687
4688 /* By default, we trust configuration from /etc and /run */
4689 if (arg_settings_trusted < 0)
4690 arg_settings_trusted = true;
4691
4692 break;
4693 }
4694
4695 if (errno != ENOENT)
4696 return log_error_errno(errno, "Failed to open %s: %m", j);
4697 }
4698
4699 if (!f) {
4700 /* After that, let's look for a file next to the
4701 * actual image we shall boot. */
4702
4703 if (arg_image) {
4704 p = file_in_same_dir(arg_image, arg_settings_filename);
4705 if (!p)
4706 return log_oom();
4707 } else if (arg_directory && !path_equal(arg_directory, "/")) {
4708 p = file_in_same_dir(arg_directory, arg_settings_filename);
4709 if (!p)
4710 return log_oom();
4711 }
4712
4713 if (p) {
4714 f = fopen(p, "re");
4715 if (!f && errno != ENOENT)
4716 return log_error_errno(errno, "Failed to open %s: %m", p);
4717
4718 /* By default, we do not trust configuration from /var/lib/machines */
4719 if (arg_settings_trusted < 0)
4720 arg_settings_trusted = false;
4721 }
4722 }
4723
4724 if (!f)
4725 return 0;
4726
4727 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4728
4729 r = settings_load(f, p, &settings);
4730 if (r < 0)
4731 return r;
4732
4733 return merge_settings(settings, p);
4734 }
4735
4736 static int load_oci_bundle(void) {
4737 _cleanup_(settings_freep) Settings *settings = NULL;
4738 int r;
4739
4740 if (!arg_oci_bundle)
4741 return 0;
4742
4743 /* By default let's trust OCI bundles */
4744 if (arg_settings_trusted < 0)
4745 arg_settings_trusted = true;
4746
4747 r = oci_load(NULL, arg_oci_bundle, &settings);
4748 if (r < 0)
4749 return r;
4750
4751 return merge_settings(settings, arg_oci_bundle);
4752 }
4753
4754 static int run_container(
4755 DissectedImage *dissected_image,
4756 bool secondary,
4757 FDSet *fds,
4758 char veth_name[IFNAMSIZ], bool *veth_created,
4759 struct ExposeArgs *expose_args,
4760 int *master, pid_t *pid, int *ret) {
4761
4762 static const struct sigaction sa = {
4763 .sa_handler = nop_signal_handler,
4764 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
4765 };
4766
4767 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
4768 _cleanup_close_ int etc_passwd_lock = -1;
4769 _cleanup_close_pair_ int
4770 kmsg_socket_pair[2] = { -1, -1 },
4771 rtnl_socket_pair[2] = { -1, -1 },
4772 pid_socket_pair[2] = { -1, -1 },
4773 uuid_socket_pair[2] = { -1, -1 },
4774 fd_socket_pair[2] = { -EBADF, -EBADF },
4775 uid_shift_socket_pair[2] = { -1, -1 },
4776 master_pty_socket_pair[2] = { -1, -1 },
4777 unified_cgroup_hierarchy_socket_pair[2] = { -1, -1};
4778
4779 _cleanup_close_ int notify_socket = -1, mntns_fd = -EBADF;
4780 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
4781 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
4782 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4783 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4784 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
4785 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
4786 _cleanup_free_ uid_t *bind_user_uid = NULL;
4787 size_t n_bind_user_uid = 0;
4788 ContainerStatus container_status = 0;
4789 int ifi = 0, r;
4790 ssize_t l;
4791 sigset_t mask_chld;
4792 _cleanup_close_ int child_netns_fd = -1;
4793
4794 assert_se(sigemptyset(&mask_chld) == 0);
4795 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4796
4797 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4798 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4799 * check with getpwuid() if the specific user already exists. Note that /etc might be
4800 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4801 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4802 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4803 * really ours. */
4804
4805 etc_passwd_lock = take_etc_passwd_lock(NULL);
4806 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4807 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4808 }
4809
4810 r = barrier_create(&barrier);
4811 if (r < 0)
4812 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4813
4814 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0)
4815 return log_error_errno(errno, "Failed to create kmsg socket pair: %m");
4816
4817 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, rtnl_socket_pair) < 0)
4818 return log_error_errno(errno, "Failed to create rtnl socket pair: %m");
4819
4820 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, pid_socket_pair) < 0)
4821 return log_error_errno(errno, "Failed to create pid socket pair: %m");
4822
4823 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uuid_socket_pair) < 0)
4824 return log_error_errno(errno, "Failed to create id socket pair: %m");
4825
4826 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_socket_pair) < 0)
4827 return log_error_errno(errno, "Failed to create notify socket pair: %m");
4828
4829 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, master_pty_socket_pair) < 0)
4830 return log_error_errno(errno, "Failed to create console socket pair: %m");
4831
4832 if (arg_userns_mode != USER_NAMESPACE_NO)
4833 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uid_shift_socket_pair) < 0)
4834 return log_error_errno(errno, "Failed to create uid shift socket pair: %m");
4835
4836 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN)
4837 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, unified_cgroup_hierarchy_socket_pair) < 0)
4838 return log_error_errno(errno, "Failed to create unified cgroup socket pair: %m");
4839
4840 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4841 * parent's blocking calls and give it a chance to call wait() and terminate. */
4842 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4843 if (r < 0)
4844 return log_error_errno(errno, "Failed to change the signal mask: %m");
4845
4846 r = sigaction(SIGCHLD, &sa, NULL);
4847 if (r < 0)
4848 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4849
4850 if (arg_network_namespace_path) {
4851 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4852 if (child_netns_fd < 0)
4853 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4854
4855 r = fd_is_ns(child_netns_fd, CLONE_NEWNET);
4856 if (r == -EUCLEAN)
4857 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4858 else if (r < 0)
4859 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
4860 else if (r == 0)
4861 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4862 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
4863 }
4864
4865 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4866 if (*pid < 0)
4867 return log_error_errno(errno, "clone() failed%s: %m",
4868 errno == EINVAL ?
4869 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4870
4871 if (*pid == 0) {
4872 /* The outer child only has a file system namespace. */
4873 barrier_set_role(&barrier, BARRIER_CHILD);
4874
4875 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
4876 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
4877 pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
4878 uuid_socket_pair[0] = safe_close(uuid_socket_pair[0]);
4879 fd_socket_pair[0] = safe_close(fd_socket_pair[0]);
4880 master_pty_socket_pair[0] = safe_close(master_pty_socket_pair[0]);
4881 uid_shift_socket_pair[0] = safe_close(uid_shift_socket_pair[0]);
4882 unified_cgroup_hierarchy_socket_pair[0] = safe_close(unified_cgroup_hierarchy_socket_pair[0]);
4883
4884 (void) reset_all_signal_handlers();
4885 (void) reset_signal_mask();
4886
4887 r = outer_child(&barrier,
4888 arg_directory,
4889 dissected_image,
4890 secondary,
4891 pid_socket_pair[1],
4892 uuid_socket_pair[1],
4893 fd_socket_pair[1],
4894 kmsg_socket_pair[1],
4895 rtnl_socket_pair[1],
4896 uid_shift_socket_pair[1],
4897 master_pty_socket_pair[1],
4898 unified_cgroup_hierarchy_socket_pair[1],
4899 fds,
4900 child_netns_fd);
4901 if (r < 0)
4902 _exit(EXIT_FAILURE);
4903
4904 _exit(EXIT_SUCCESS);
4905 }
4906
4907 barrier_set_role(&barrier, BARRIER_PARENT);
4908
4909 fdset_close(fds);
4910
4911 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
4912 rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
4913 pid_socket_pair[1] = safe_close(pid_socket_pair[1]);
4914 uuid_socket_pair[1] = safe_close(uuid_socket_pair[1]);
4915 fd_socket_pair[1] = safe_close(fd_socket_pair[1]);
4916 master_pty_socket_pair[1] = safe_close(master_pty_socket_pair[1]);
4917 uid_shift_socket_pair[1] = safe_close(uid_shift_socket_pair[1]);
4918 unified_cgroup_hierarchy_socket_pair[1] = safe_close(unified_cgroup_hierarchy_socket_pair[1]);
4919
4920 if (arg_userns_mode != USER_NAMESPACE_NO) {
4921 mntns_fd = receive_one_fd(fd_socket_pair[0], 0);
4922 if (mntns_fd < 0)
4923 return log_error_errno(mntns_fd, "Failed to receive mount namespace fd from outer child: %m");
4924
4925 /* The child just let us know the UID shift it might have read from the image. */
4926 l = recv(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
4927 if (l < 0)
4928 return log_error_errno(errno, "Failed to read UID shift: %m");
4929 if (l != sizeof arg_uid_shift)
4930 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
4931
4932 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4933 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4934 * image, but if that's already in use, pick a new one, and report back to the child,
4935 * which one we now picked. */
4936
4937 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4938 if (r < 0)
4939 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4940
4941 l = send(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
4942 if (l < 0)
4943 return log_error_errno(errno, "Failed to send UID shift: %m");
4944 if (l != sizeof arg_uid_shift)
4945 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
4946 }
4947
4948 n_bind_user_uid = strv_length(arg_bind_user);
4949 if (n_bind_user_uid > 0) {
4950 /* Right after the UID shift, we'll receive the list of UID mappings for the
4951 * --bind-user= logic. Always a quadruplet of payload and host UID + GID. */
4952
4953 bind_user_uid = new(uid_t, n_bind_user_uid*4);
4954 if (!bind_user_uid)
4955 return log_oom();
4956
4957 for (size_t i = 0; i < n_bind_user_uid; i++) {
4958 l = recv(uid_shift_socket_pair[0], bind_user_uid + i*4, sizeof(uid_t)*4, 0);
4959 if (l < 0)
4960 return log_error_errno(errno, "Failed to read user UID map pair: %m");
4961 if (l != sizeof(uid_t)*4)
4962 return log_full_errno(l == 0 ? LOG_DEBUG : LOG_WARNING,
4963 SYNTHETIC_ERRNO(EIO),
4964 "Short read while reading bind user UID pairs.");
4965 }
4966 }
4967 }
4968
4969 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4970 /* The child let us know the support cgroup mode it might have read from the image. */
4971 l = recv(unified_cgroup_hierarchy_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
4972 if (l < 0)
4973 return log_error_errno(errno, "Failed to read cgroup mode: %m");
4974 if (l != sizeof(arg_unified_cgroup_hierarchy))
4975 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
4976 l, l == 0 ? " The child is most likely dead." : "");
4977 }
4978
4979 /* Wait for the outer child. */
4980 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4981 if (r < 0)
4982 return r;
4983 if (r != EXIT_SUCCESS)
4984 return -EIO;
4985
4986 /* And now retrieve the PID of the inner child. */
4987 l = recv(pid_socket_pair[0], pid, sizeof *pid, 0);
4988 if (l < 0)
4989 return log_error_errno(errno, "Failed to read inner child PID: %m");
4990 if (l != sizeof *pid)
4991 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
4992
4993 /* We also retrieve container UUID in case it was generated by outer child */
4994 l = recv(uuid_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
4995 if (l < 0)
4996 return log_error_errno(errno, "Failed to read container machine ID: %m");
4997 if (l != sizeof(arg_uuid))
4998 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
4999
5000 /* We also retrieve the socket used for notifications generated by outer child */
5001 notify_socket = receive_one_fd(fd_socket_pair[0], 0);
5002 if (notify_socket < 0)
5003 return log_error_errno(notify_socket,
5004 "Failed to receive notification socket from the outer child: %m");
5005
5006 log_debug("Init process invoked as PID "PID_FMT, *pid);
5007
5008 if (arg_userns_mode != USER_NAMESPACE_NO) {
5009 if (!barrier_place_and_sync(&barrier)) /* #1 */
5010 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
5011
5012 r = setup_uid_map(*pid, bind_user_uid, n_bind_user_uid);
5013 if (r < 0)
5014 return r;
5015
5016 (void) barrier_place(&barrier); /* #2 */
5017 }
5018
5019 if (arg_private_network) {
5020 if (!arg_network_namespace_path) {
5021 /* Wait until the child has unshared its network namespace. */
5022 if (!barrier_place_and_sync(&barrier)) /* #3 */
5023 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
5024 }
5025
5026 if (child_netns_fd < 0) {
5027 /* Make sure we have an open file descriptor to the child's network
5028 * namespace so it stays alive even if the child exits. */
5029 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
5030 if (r < 0)
5031 return log_error_errno(r, "Failed to open child network namespace: %m");
5032 }
5033
5034 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
5035 if (r < 0)
5036 return r;
5037
5038 if (arg_network_veth) {
5039 r = setup_veth(arg_machine, *pid, veth_name,
5040 arg_network_bridge || arg_network_zone);
5041 if (r < 0)
5042 return r;
5043 else if (r > 0)
5044 ifi = r;
5045
5046 if (arg_network_bridge) {
5047 /* Add the interface to a bridge */
5048 r = setup_bridge(veth_name, arg_network_bridge, false);
5049 if (r < 0)
5050 return r;
5051 if (r > 0)
5052 ifi = r;
5053 } else if (arg_network_zone) {
5054 /* Add the interface to a bridge, possibly creating it */
5055 r = setup_bridge(veth_name, arg_network_zone, true);
5056 if (r < 0)
5057 return r;
5058 if (r > 0)
5059 ifi = r;
5060 }
5061 }
5062
5063 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
5064 if (r < 0)
5065 return r;
5066
5067 /* We created the primary and extra veth links now; let's remember this, so that we know to
5068 remove them later on. Note that we don't bother with removing veth links that were created
5069 here when their setup failed half-way, because in that case the kernel should be able to
5070 remove them on its own, since they cannot be referenced by anything yet. */
5071 *veth_created = true;
5072
5073 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
5074 if (r < 0)
5075 return r;
5076
5077 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
5078 if (r < 0)
5079 return r;
5080 }
5081
5082 if (arg_register || !arg_keep_unit) {
5083 r = sd_bus_default_system(&bus);
5084 if (r < 0)
5085 return log_error_errno(r, "Failed to open system bus: %m");
5086
5087 r = sd_bus_set_close_on_exit(bus, false);
5088 if (r < 0)
5089 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
5090 }
5091
5092 if (!arg_keep_unit) {
5093 /* When a new scope is created for this container, then we'll be registered as its controller, in which
5094 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
5095 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
5096
5097 r = sd_bus_match_signal_async(
5098 bus,
5099 NULL,
5100 "org.freedesktop.systemd1",
5101 NULL,
5102 "org.freedesktop.systemd1.Scope",
5103 "RequestStop",
5104 on_request_stop, NULL, PID_TO_PTR(*pid));
5105 if (r < 0)
5106 return log_error_errno(r, "Failed to request RequestStop match: %m");
5107 }
5108
5109 if (arg_register) {
5110 r = register_machine(
5111 bus,
5112 arg_machine,
5113 *pid,
5114 arg_directory,
5115 arg_uuid,
5116 ifi,
5117 arg_slice,
5118 arg_custom_mounts, arg_n_custom_mounts,
5119 arg_kill_signal,
5120 arg_property,
5121 arg_property_message,
5122 arg_keep_unit,
5123 arg_container_service_name);
5124 if (r < 0)
5125 return r;
5126
5127 } else if (!arg_keep_unit) {
5128 r = allocate_scope(
5129 bus,
5130 arg_machine,
5131 *pid,
5132 arg_slice,
5133 arg_custom_mounts, arg_n_custom_mounts,
5134 arg_kill_signal,
5135 arg_property,
5136 arg_property_message);
5137 if (r < 0)
5138 return r;
5139
5140 } else if (arg_slice || arg_property)
5141 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
5142
5143 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
5144 if (r < 0)
5145 return r;
5146
5147 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
5148 if (r < 0)
5149 return r;
5150
5151 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
5152 if (r < 0)
5153 return r;
5154
5155 /* Notify the child that the parent is ready with all
5156 * its setup (including cgroup-ification), and that
5157 * the child can now hand over control to the code to
5158 * run inside the container. */
5159 (void) barrier_place(&barrier); /* #4 */
5160
5161 /* Block SIGCHLD here, before notifying child.
5162 * process_pty() will handle it with the other signals. */
5163 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
5164
5165 /* Reset signal to default */
5166 r = default_signals(SIGCHLD);
5167 if (r < 0)
5168 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
5169
5170 r = sd_event_new(&event);
5171 if (r < 0)
5172 return log_error_errno(r, "Failed to get default event source: %m");
5173
5174 (void) sd_event_set_watchdog(event, true);
5175
5176 if (bus) {
5177 r = sd_bus_attach_event(bus, event, 0);
5178 if (r < 0)
5179 return log_error_errno(r, "Failed to attach bus to event loop: %m");
5180 }
5181
5182 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
5183 if (r < 0)
5184 return r;
5185
5186 if (arg_userns_mode != USER_NAMESPACE_NO) {
5187 r = wipe_fully_visible_fs(mntns_fd);
5188 if (r < 0)
5189 return r;
5190 mntns_fd = safe_close(mntns_fd);
5191 }
5192
5193 /* Let the child know that we are ready and wait that the child is completely ready now. */
5194 if (!barrier_place_and_sync(&barrier)) /* #5 */
5195 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
5196
5197 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
5198 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
5199 etc_passwd_lock = safe_close(etc_passwd_lock);
5200
5201 (void) sd_notifyf(false,
5202 "STATUS=Container running.\n"
5203 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
5204 if (!arg_notify_ready) {
5205 r = sd_notify(false, "READY=1\n");
5206 if (r < 0)
5207 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
5208 }
5209
5210 if (arg_kill_signal > 0) {
5211 /* Try to kill the init system on SIGINT or SIGTERM */
5212 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
5213 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
5214 } else {
5215 /* Immediately exit */
5216 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
5217 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
5218 }
5219
5220 /* Exit when the child exits */
5221 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
5222
5223 if (arg_expose_ports) {
5224 r = expose_port_watch_rtnl(event, rtnl_socket_pair[0], on_address_change, expose_args, &rtnl);
5225 if (r < 0)
5226 return r;
5227
5228 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5229 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
5230 }
5231
5232 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
5233
5234 if (arg_console_mode != CONSOLE_PIPE) {
5235 _cleanup_close_ int fd = -1;
5236 PTYForwardFlags flags = 0;
5237
5238 /* Retrieve the master pty allocated by inner child */
5239 fd = receive_one_fd(master_pty_socket_pair[0], 0);
5240 if (fd < 0)
5241 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
5242
5243 switch (arg_console_mode) {
5244
5245 case CONSOLE_READ_ONLY:
5246 flags |= PTY_FORWARD_READ_ONLY;
5247
5248 _fallthrough_;
5249
5250 case CONSOLE_INTERACTIVE:
5251 flags |= PTY_FORWARD_IGNORE_VHANGUP;
5252
5253 r = pty_forward_new(event, fd, flags, &forward);
5254 if (r < 0)
5255 return log_error_errno(r, "Failed to create PTY forwarder: %m");
5256
5257 if (arg_console_width != UINT_MAX || arg_console_height != UINT_MAX)
5258 (void) pty_forward_set_width_height(forward,
5259 arg_console_width,
5260 arg_console_height);
5261 break;
5262
5263 default:
5264 assert(arg_console_mode == CONSOLE_PASSIVE);
5265 }
5266
5267 *master = TAKE_FD(fd);
5268 }
5269
5270 r = sd_event_loop(event);
5271 if (r < 0)
5272 return log_error_errno(r, "Failed to run event loop: %m");
5273
5274 if (forward) {
5275 char last_char = 0;
5276
5277 (void) pty_forward_get_last_char(forward, &last_char);
5278 forward = pty_forward_free(forward);
5279
5280 if (!arg_quiet && last_char != '\n')
5281 putc('\n', stdout);
5282 }
5283
5284 /* Kill if it is not dead yet anyway */
5285 if (!arg_register && !arg_keep_unit && bus)
5286 terminate_scope(bus, arg_machine);
5287
5288 /* Normally redundant, but better safe than sorry */
5289 (void) kill(*pid, SIGKILL);
5290
5291 if (arg_private_network) {
5292 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
5293 * to avoid having to move the parent to the child network namespace. */
5294 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
5295 if (r < 0)
5296 return r;
5297
5298 if (r == 0) {
5299 _cleanup_close_ int parent_netns_fd = -1;
5300
5301 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
5302 if (r < 0) {
5303 log_error_errno(r, "Failed to open parent network namespace: %m");
5304 _exit(EXIT_FAILURE);
5305 }
5306
5307 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
5308 if (r < 0) {
5309 log_error_errno(r, "Failed to enter child network namespace: %m");
5310 _exit(EXIT_FAILURE);
5311 }
5312
5313 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
5314 if (r < 0)
5315 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
5316
5317 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
5318 }
5319 }
5320
5321 r = wait_for_container(TAKE_PID(*pid), &container_status);
5322
5323 /* Tell machined that we are gone. */
5324 if (bus)
5325 (void) unregister_machine(bus, arg_machine);
5326
5327 if (r < 0)
5328 /* We failed to wait for the container, or the container exited abnormally. */
5329 return r;
5330 if (r > 0 || container_status == CONTAINER_TERMINATED) {
5331 /* r > 0 → The container exited with a non-zero status.
5332 * As a special case, we need to replace 133 with a different value,
5333 * because 133 is special-cased in the service file to reboot the container.
5334 * otherwise → The container exited with zero status and a reboot was not requested.
5335 */
5336 if (r == EXIT_FORCE_RESTART)
5337 r = EXIT_FAILURE; /* replace 133 with the general failure code */
5338 *ret = r;
5339 return 0; /* finito */
5340 }
5341
5342 /* CONTAINER_REBOOTED, loop again */
5343
5344 if (arg_keep_unit) {
5345 /* Special handling if we are running as a service: instead of simply
5346 * restarting the machine we want to restart the entire service, so let's
5347 * inform systemd about this with the special exit code 133. The service
5348 * file uses RestartForceExitStatus=133 so that this results in a full
5349 * nspawn restart. This is necessary since we might have cgroup parameters
5350 * set we want to have flushed out. */
5351 *ret = EXIT_FORCE_RESTART;
5352 return 0; /* finito */
5353 }
5354
5355 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5356 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
5357
5358 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5359 *veth_created = false;
5360 return 1; /* loop again */
5361 }
5362
5363 static int initialize_rlimits(void) {
5364 /* The default resource limits the kernel passes to PID 1, as per kernel 5.16. Let's pass our container payload
5365 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
5366 * container execution environments. */
5367
5368 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
5369 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
5370 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
5371 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
5372 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
5373 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
5374 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
5375 [RLIMIT_MEMLOCK] = { DEFAULT_RLIMIT_MEMLOCK, DEFAULT_RLIMIT_MEMLOCK },
5376 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
5377 [RLIMIT_NICE] = { 0, 0 },
5378 [RLIMIT_NOFILE] = { 1024, 4096 },
5379 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
5380 [RLIMIT_RTPRIO] = { 0, 0 },
5381 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
5382 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
5383
5384 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
5385 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
5386 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
5387 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
5388 * that PID 1 changes a number of other resource limits during early initialization which is why we
5389 * don't read the other limits from PID 1 but prefer the static table above. */
5390 };
5391
5392 int rl;
5393
5394 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
5395 /* Let's only fill in what the user hasn't explicitly configured anyway */
5396 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
5397 const struct rlimit *v;
5398 struct rlimit buffer;
5399
5400 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
5401 /* For these two let's read the limits off PID 1. See above for an explanation. */
5402
5403 if (prlimit(1, rl, NULL, &buffer) < 0)
5404 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
5405
5406 v = &buffer;
5407 } else if (rl == RLIMIT_NOFILE) {
5408 /* We nowadays bump RLIMIT_NOFILE's hard limit early in PID 1 for all
5409 * userspace. Given that nspawn containers are often run without our PID 1,
5410 * let's grant the containers a raised RLIMIT_NOFILE hard limit by default,
5411 * so that container userspace gets similar resources as host userspace
5412 * gets. */
5413 buffer = kernel_defaults[rl];
5414 buffer.rlim_max = MIN((rlim_t) read_nr_open(), (rlim_t) HIGH_RLIMIT_NOFILE);
5415 v = &buffer;
5416 } else
5417 v = kernel_defaults + rl;
5418
5419 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
5420 if (!arg_rlimit[rl])
5421 return log_oom();
5422 }
5423
5424 if (DEBUG_LOGGING) {
5425 _cleanup_free_ char *k = NULL;
5426
5427 (void) rlimit_format(arg_rlimit[rl], &k);
5428 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
5429 }
5430 }
5431
5432 return 0;
5433 }
5434
5435 static int cant_be_in_netns(void) {
5436 _cleanup_close_ int fd = -1;
5437 struct ucred ucred;
5438 int r;
5439
5440 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
5441 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
5442 * nice message. */
5443
5444 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
5445 return 0;
5446
5447 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
5448 if (fd < 0)
5449 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
5450
5451 r = connect_unix_path(fd, AT_FDCWD, "/run/udev/control");
5452 if (r < 0) {
5453 if (r == -ENOENT || ERRNO_IS_DISCONNECT(r))
5454 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5455 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
5456
5457 return log_error_errno(r, "Failed to connect socket to udev control socket: %m");
5458 }
5459
5460 r = getpeercred(fd, &ucred);
5461 if (r < 0)
5462 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
5463
5464 r = in_same_namespace(ucred.pid, 0, NAMESPACE_NET);
5465 if (r < 0)
5466 return log_error_errno(r, "Failed to determine network namespace of udev: %m");
5467 if (r == 0)
5468 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5469 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
5470 return 0;
5471 }
5472
5473 static int run(int argc, char *argv[]) {
5474 bool secondary = false, remove_directory = false, remove_image = false,
5475 veth_created = false, remove_tmprootdir = false;
5476 _cleanup_close_ int master = -1;
5477 _cleanup_fdset_free_ FDSet *fds = NULL;
5478 int r, n_fd_passed, ret = EXIT_SUCCESS;
5479 char veth_name[IFNAMSIZ] = "";
5480 struct ExposeArgs expose_args = {};
5481 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
5482 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
5483 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
5484 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
5485 _cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
5486 pid_t pid = 0;
5487
5488 log_parse_environment();
5489 log_open();
5490
5491 r = parse_argv(argc, argv);
5492 if (r <= 0)
5493 goto finish;
5494
5495 if (geteuid() != 0) {
5496 r = log_warning_errno(SYNTHETIC_ERRNO(EPERM),
5497 argc >= 2 ? "Need to be root." :
5498 "Need to be root (and some arguments are usually required).\nHint: try --help");
5499 goto finish;
5500 }
5501
5502 r = cant_be_in_netns();
5503 if (r < 0)
5504 goto finish;
5505
5506 r = initialize_rlimits();
5507 if (r < 0)
5508 goto finish;
5509
5510 r = load_oci_bundle();
5511 if (r < 0)
5512 goto finish;
5513
5514 r = determine_names();
5515 if (r < 0)
5516 goto finish;
5517
5518 r = load_settings();
5519 if (r < 0)
5520 goto finish;
5521
5522 r = cg_unified();
5523 if (r < 0) {
5524 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
5525 goto finish;
5526 }
5527
5528 r = verify_arguments();
5529 if (r < 0)
5530 goto finish;
5531
5532 /* Reapply environment settings. */
5533 (void) detect_unified_cgroup_hierarchy_from_environment();
5534
5535 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
5536 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
5537 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
5538 (void) ignore_signals(SIGPIPE);
5539
5540 n_fd_passed = sd_listen_fds(false);
5541 if (n_fd_passed > 0) {
5542 r = fdset_new_listen_fds(&fds, false);
5543 if (r < 0) {
5544 log_error_errno(r, "Failed to collect file descriptors: %m");
5545 goto finish;
5546 }
5547 }
5548
5549 /* The "default" umask. This is appropriate for most file and directory
5550 * operations performed by nspawn, and is the umask that will be used for
5551 * the child. Functions like copy_devnodes() change the umask temporarily. */
5552 umask(0022);
5553
5554 if (arg_directory) {
5555 assert(!arg_image);
5556
5557 /* Safety precaution: let's not allow running images from the live host OS image, as long as
5558 * /var from the host will propagate into container dynamically (because bad things happen if
5559 * two systems write to the same /var). Let's allow it for the special cases where /var is
5560 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
5561 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
5562 log_error("Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
5563 r = -EINVAL;
5564 goto finish;
5565 }
5566
5567 if (arg_ephemeral) {
5568 _cleanup_free_ char *np = NULL;
5569
5570 r = chase_symlinks_and_update(&arg_directory, 0);
5571 if (r < 0)
5572 goto finish;
5573
5574 /* If the specified path is a mount point we generate the new snapshot immediately
5575 * inside it under a random name. However if the specified is not a mount point we
5576 * create the new snapshot in the parent directory, just next to it. */
5577 r = path_is_mount_point(arg_directory, NULL, 0);
5578 if (r < 0) {
5579 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5580 goto finish;
5581 }
5582 if (r > 0)
5583 r = tempfn_random_child(arg_directory, "machine.", &np);
5584 else
5585 r = tempfn_random(arg_directory, "machine.", &np);
5586 if (r < 0) {
5587 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
5588 goto finish;
5589 }
5590
5591 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
5592 * only owned by us and no one else. */
5593 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
5594 if (r < 0) {
5595 log_error_errno(r, "Failed to lock %s: %m", np);
5596 goto finish;
5597 }
5598
5599 {
5600 BLOCK_SIGNALS(SIGINT);
5601 r = btrfs_subvol_snapshot(arg_directory, np,
5602 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5603 BTRFS_SNAPSHOT_FALLBACK_COPY |
5604 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5605 BTRFS_SNAPSHOT_RECURSIVE |
5606 BTRFS_SNAPSHOT_QUOTA |
5607 BTRFS_SNAPSHOT_SIGINT);
5608 }
5609 if (r == -EINTR) {
5610 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5611 goto finish;
5612 }
5613 if (r < 0) {
5614 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5615 goto finish;
5616 }
5617
5618 free_and_replace(arg_directory, np);
5619 remove_directory = true;
5620 } else {
5621 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
5622 if (r < 0)
5623 goto finish;
5624
5625 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5626 if (r == -EBUSY) {
5627 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5628 goto finish;
5629 }
5630 if (r < 0) {
5631 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
5632 goto finish;
5633 }
5634
5635 if (arg_template) {
5636 r = chase_symlinks_and_update(&arg_template, 0);
5637 if (r < 0)
5638 goto finish;
5639
5640 {
5641 BLOCK_SIGNALS(SIGINT);
5642 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5643 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5644 BTRFS_SNAPSHOT_FALLBACK_COPY |
5645 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5646 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5647 BTRFS_SNAPSHOT_RECURSIVE |
5648 BTRFS_SNAPSHOT_QUOTA |
5649 BTRFS_SNAPSHOT_SIGINT);
5650 }
5651 if (r == -EEXIST)
5652 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5653 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
5654 else if (r == -EINTR) {
5655 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5656 goto finish;
5657 } else if (r < 0) {
5658 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
5659 goto finish;
5660 } else
5661 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5662 "Populated %s from template %s.", arg_directory, arg_template);
5663 }
5664 }
5665
5666 if (arg_start_mode == START_BOOT) {
5667 _cleanup_free_ char *b = NULL;
5668 const char *p;
5669
5670 if (arg_pivot_root_new) {
5671 b = path_join(arg_directory, arg_pivot_root_new);
5672 if (!b)
5673 return log_oom();
5674
5675 p = b;
5676 } else
5677 p = arg_directory;
5678
5679 if (path_is_os_tree(p) <= 0) {
5680 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5681 "Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
5682 goto finish;
5683 }
5684 } else {
5685 _cleanup_free_ char *p = NULL;
5686
5687 if (arg_pivot_root_new)
5688 p = path_join(arg_directory, arg_pivot_root_new, "/usr/");
5689 else
5690 p = path_join(arg_directory, "/usr/");
5691 if (!p)
5692 return log_oom();
5693
5694 if (laccess(p, F_OK) < 0) {
5695 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5696 "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
5697 goto finish;
5698 }
5699 }
5700
5701 } else {
5702 DissectImageFlags dissect_image_flags =
5703 DISSECT_IMAGE_GENERIC_ROOT |
5704 DISSECT_IMAGE_REQUIRE_ROOT |
5705 DISSECT_IMAGE_RELAX_VAR_CHECK |
5706 DISSECT_IMAGE_USR_NO_ROOT |
5707 DISSECT_IMAGE_ADD_PARTITION_DEVICES |
5708 DISSECT_IMAGE_PIN_PARTITION_DEVICES;
5709 assert(arg_image);
5710 assert(!arg_template);
5711
5712 r = chase_symlinks_and_update(&arg_image, 0);
5713 if (r < 0)
5714 goto finish;
5715
5716 if (arg_ephemeral) {
5717 _cleanup_free_ char *np = NULL;
5718
5719 r = tempfn_random(arg_image, "machine.", &np);
5720 if (r < 0) {
5721 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5722 goto finish;
5723 }
5724
5725 /* Always take an exclusive lock on our own ephemeral copy. */
5726 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
5727 if (r < 0) {
5728 r = log_error_errno(r, "Failed to create image lock: %m");
5729 goto finish;
5730 }
5731
5732 {
5733 BLOCK_SIGNALS(SIGINT);
5734 r = copy_file(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600, FS_NOCOW_FL, FS_NOCOW_FL, COPY_REFLINK|COPY_CRTIME|COPY_SIGINT);
5735 }
5736 if (r == -EINTR) {
5737 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5738 goto finish;
5739 }
5740 if (r < 0) {
5741 r = log_error_errno(r, "Failed to copy image file: %m");
5742 goto finish;
5743 }
5744
5745 free_and_replace(arg_image, np);
5746 remove_image = true;
5747 } else {
5748 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5749 if (r == -EBUSY) {
5750 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5751 goto finish;
5752 }
5753 if (r < 0) {
5754 r = log_error_errno(r, "Failed to create image lock: %m");
5755 goto finish;
5756 }
5757
5758 r = verity_settings_load(
5759 &arg_verity_settings,
5760 arg_image, NULL, NULL);
5761 if (r < 0) {
5762 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5763 goto finish;
5764 }
5765
5766 if (arg_verity_settings.data_path)
5767 dissect_image_flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
5768 }
5769
5770 if (!mkdtemp(tmprootdir)) {
5771 r = log_error_errno(errno, "Failed to create temporary directory: %m");
5772 goto finish;
5773 }
5774
5775 remove_tmprootdir = true;
5776
5777 arg_directory = strdup(tmprootdir);
5778 if (!arg_directory) {
5779 r = log_oom();
5780 goto finish;
5781 }
5782
5783 r = loop_device_make_by_path(
5784 arg_image,
5785 arg_read_only ? O_RDONLY : O_RDWR,
5786 FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
5787 LOCK_SH,
5788 &loop);
5789 if (r < 0) {
5790 log_error_errno(r, "Failed to set up loopback block device: %m");
5791 goto finish;
5792 }
5793
5794 r = dissect_loop_device_and_warn(
5795 loop,
5796 &arg_verity_settings,
5797 NULL,
5798 dissect_image_flags,
5799 &dissected_image);
5800 if (r == -ENOPKG) {
5801 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
5802 log_notice("Note that the disk image needs to\n"
5803 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5804 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
5805 " c) or follow https://uapi-group.org/specifications/specs/discoverable_partitions_specification\n"
5806 " d) or contain a file system without a partition table\n"
5807 "in order to be bootable with systemd-nspawn.");
5808 goto finish;
5809 }
5810 if (r < 0)
5811 goto finish;
5812
5813 r = dissected_image_load_verity_sig_partition(
5814 dissected_image,
5815 loop->fd,
5816 &arg_verity_settings);
5817 if (r < 0)
5818 goto finish;
5819
5820 if (dissected_image->has_verity && !arg_verity_settings.root_hash && !dissected_image->has_verity_sig)
5821 log_notice("Note: image %s contains verity information, but no root hash specified and no embedded "
5822 "root hash signature found! Proceeding without integrity checking.", arg_image);
5823
5824 r = dissected_image_decrypt_interactively(
5825 dissected_image,
5826 NULL,
5827 &arg_verity_settings,
5828 0);
5829 if (r < 0)
5830 goto finish;
5831
5832 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5833 if (remove_image && unlink(arg_image) >= 0)
5834 remove_image = false;
5835 }
5836
5837 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5838 if (r < 0)
5839 goto finish;
5840
5841 if (arg_console_mode < 0)
5842 arg_console_mode =
5843 isatty(STDIN_FILENO) > 0 &&
5844 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
5845
5846 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5847 arg_quiet = true;
5848
5849 if (!arg_quiet)
5850 log_info("Spawning container %s on %s.\nPress Ctrl-] three times within 1s to kill container.",
5851 arg_machine, arg_image ?: arg_directory);
5852
5853 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
5854
5855 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
5856 r = log_error_errno(errno, "Failed to become subreaper: %m");
5857 goto finish;
5858 }
5859
5860 if (arg_expose_ports) {
5861 r = fw_ctx_new(&fw_ctx);
5862 if (r < 0) {
5863 log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
5864 goto finish;
5865 }
5866 expose_args.fw_ctx = fw_ctx;
5867 }
5868 for (;;) {
5869 r = run_container(dissected_image,
5870 secondary,
5871 fds,
5872 veth_name, &veth_created,
5873 &expose_args, &master,
5874 &pid, &ret);
5875 if (r <= 0)
5876 break;
5877 }
5878
5879 finish:
5880 (void) sd_notify(false,
5881 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5882 "STOPPING=1\nSTATUS=Terminating...");
5883
5884 if (pid > 0)
5885 (void) kill(pid, SIGKILL);
5886
5887 /* Try to flush whatever is still queued in the pty */
5888 if (master >= 0) {
5889 (void) copy_bytes(master, STDOUT_FILENO, UINT64_MAX, 0);
5890 master = safe_close(master);
5891 }
5892
5893 if (pid > 0)
5894 (void) wait_for_terminate(pid, NULL);
5895
5896 pager_close();
5897
5898 if (remove_directory && arg_directory) {
5899 int k;
5900
5901 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
5902 if (k < 0)
5903 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
5904 }
5905
5906 if (remove_image && arg_image) {
5907 if (unlink(arg_image) < 0)
5908 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5909 }
5910
5911 if (remove_tmprootdir) {
5912 if (rmdir(tmprootdir) < 0)
5913 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5914 }
5915
5916 if (arg_machine) {
5917 const char *p;
5918
5919 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
5920 (void) rm_rf(p, REMOVE_ROOT);
5921 }
5922
5923 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET, &expose_args.address4);
5924 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET6, &expose_args.address6);
5925
5926 if (veth_created)
5927 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5928 (void) remove_bridge(arg_network_zone);
5929
5930 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5931 expose_port_free_all(arg_expose_ports);
5932 rlimit_free_all(arg_rlimit);
5933 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
5934 credential_free_all(arg_credentials, arg_n_credentials);
5935
5936 if (r < 0)
5937 return r;
5938
5939 return ret;
5940 }
5941
5942 DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.