src/shared/machine-image.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2013 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <dirent.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/file.h>
  27 #include <sys/stat.h>
  28 #include <unistd.h>
  29 #include <linux/fs.h>
  30
  31 #include "alloc-util.h"
  32 #include "btrfs-util.h"
  33 #include "chattr-util.h"
  34 #include "copy.h"
  35 #include "dirent-util.h"
  36 #include "env-util.h"
  37 #include "fd-util.h"
  38 #include "fs-util.h"
  39 #include "hashmap.h"
  40 #include "lockfile-util.h"
  41 #include "log.h"
  42 #include "machine-image.h"
  43 #include "macro.h"
  44 #include "mkdir.h"
  45 #include "path-util.h"
  46 #include "rm-rf.h"
  47 #include "string-table.h"
  48 #include "string-util.h"
  49 #include "strv.h"
  50 #include "time-util.h"
  51 #include "utf8.h"
  52 #include "util.h"
  53 #include "xattr-util.h"
  54
  55 static const char image_search_path[] =
  56         "/var/lib/machines\0"
  57         "/var/lib/container\0" /* legacy */
  58         "/usr/local/lib/machines\0"
  59         "/usr/lib/machines\0";
  60
  61 Image *image_unref(Image *i) {
  62         if (!i)
  63                 return NULL;
  64
  65         free(i->name);
  66         free(i->path);
  67         return mfree(i);
  68 }
  69
  70 static char **image_settings_path(Image *image) {
  71         _cleanup_strv_free_ char **l = NULL;
  72         char **ret;
  73         const char *fn, *s;
  74         unsigned i = 0;
  75
  76         assert(image);
  77
  78         l = new0(char*, 4);
  79         if (!l)
  80                 return NULL;
  81
  82         fn = strjoina(image->name, ".nspawn");
  83
  84         FOREACH_STRING(s, "/etc/systemd/nspawn/", "/run/systemd/nspawn/") {
  85                 l[i] = strappend(s, fn);
  86                 if (!l[i])
  87                         return NULL;
  88
  89                 i++;
  90         }
  91
  92         l[i] = file_in_same_dir(image->path, fn);
  93         if (!l[i])
  94                 return NULL;
  95
  96         ret = l;
  97         l = NULL;
  98
  99         return ret;
 100 }
 101
 102 static char *image_roothash_path(Image *image) {
 103         const char *fn;
 104
 105         assert(image);
 106
 107         fn = strjoina(image->name, ".roothash");
 108
 109         return file_in_same_dir(image->path, fn);
 110 }
 111
 112 static int image_new(
 113                 ImageType t,
 114                 const char *pretty,
 115                 const char *path,
 116                 const char *filename,
 117                 bool read_only,
 118                 usec_t crtime,
 119                 usec_t mtime,
 120                 Image **ret) {
 121
 122         _cleanup_(image_unrefp) Image *i = NULL;
 123
 124         assert(t >= 0);
 125         assert(t < _IMAGE_TYPE_MAX);
 126         assert(pretty);
 127         assert(filename);
 128         assert(ret);
 129
 130         i = new0(Image, 1);
 131         if (!i)
 132                 return -ENOMEM;
 133
 134         i->type = t;
 135         i->read_only = read_only;
 136         i->crtime = crtime;
 137         i->mtime = mtime;
 138         i->usage = i->usage_exclusive = (uint64_t) -1;
 139         i->limit = i->limit_exclusive = (uint64_t) -1;
 140
 141         i->name = strdup(pretty);
 142         if (!i->name)
 143                 return -ENOMEM;
 144
 145         if (path)
 146                 i->path = strjoin(path, "/", filename);
 147         else
 148                 i->path = strdup(filename);
 149
 150         if (!i->path)
 151                 return -ENOMEM;
 152
 153         path_kill_slashes(i->path);
 154
 155         *ret = i;
 156         i = NULL;
 157
 158         return 0;
 159 }
 160
 161 static int image_make(
 162                 const char *pretty,
 163                 int dfd,
 164                 const char *path,
 165                 const char *filename,
 166                 Image **ret) {
 167
 168         struct stat st;
 169         bool read_only;
 170         int r;
 171
 172         assert(filename);
 173
 174         /* We explicitly *do* follow symlinks here, since we want to
 175          * allow symlinking trees into /var/lib/machines/, and treat
 176          * them normally. */
 177
 178         if (fstatat(dfd, filename, &st, 0) < 0)
 179                 return -errno;
 180
 181         read_only =
 182                 (path && path_startswith(path, "/usr")) ||
 183                 (faccessat(dfd, filename, W_OK, AT_EACCESS) < 0 && errno == EROFS);
 184
 185         if (S_ISDIR(st.st_mode)) {
 186                 _cleanup_close_ int fd = -1;
 187                 unsigned file_attr = 0;
 188
 189                 if (!ret)
 190                         return 1;
 191
 192                 if (!pretty)
 193                         pretty = filename;
 194
 195                 fd = openat(dfd, filename, O_CLOEXEC|O_NOCTTY|O_DIRECTORY);
 196                 if (fd < 0)
 197                         return -errno;
 198
 199                 /* btrfs subvolumes have inode 256 */
 200                 if (st.st_ino == 256) {
 201
 202                         r = btrfs_is_filesystem(fd);
 203                         if (r < 0)
 204                                 return r;
 205                         if (r) {
 206                                 BtrfsSubvolInfo info;
 207
 208                                 /* It's a btrfs subvolume */
 209
 210                                 r = btrfs_subvol_get_info_fd(fd, 0, &info);
 211                                 if (r < 0)
 212                                         return r;
 213
 214                                 r = image_new(IMAGE_SUBVOLUME,
 215                                               pretty,
 216                                               path,
 217                                               filename,
 218                                               info.read_only || read_only,
 219                                               info.otime,
 220                                               0,
 221                                               ret);
 222                                 if (r < 0)
 223                                         return r;
 224
 225                                 if (btrfs_quota_scan_ongoing(fd) == 0) {
 226                                         BtrfsQuotaInfo quota;
 227
 228                                         r = btrfs_subvol_get_subtree_quota_fd(fd, 0, &quota);
 229                                         if (r >= 0) {
 230                                                 (*ret)->usage = quota.referenced;
 231                                                 (*ret)->usage_exclusive = quota.exclusive;
 232
 233                                                 (*ret)->limit = quota.referenced_max;
 234                                                 (*ret)->limit_exclusive = quota.exclusive_max;
 235                                         }
 236                                 }
 237
 238                                 return 1;
 239                         }
 240                 }
 241
 242                 /* If the IMMUTABLE bit is set, we consider the
 243                  * directory read-only. Since the ioctl is not
 244                  * supported everywhere we ignore failures. */
 245                 (void) read_attr_fd(fd, &file_attr);
 246
 247                 /* It's just a normal directory. */
 248                 r = image_new(IMAGE_DIRECTORY,
 249                               pretty,
 250                               path,
 251                               filename,
 252                               read_only || (file_attr & FS_IMMUTABLE_FL),
 253                               0,
 254                               0,
 255                               ret);
 256                 if (r < 0)
 257                         return r;
 258
 259                 return 1;
 260
 261         } else if (S_ISREG(st.st_mode) && endswith(filename, ".raw")) {
 262                 usec_t crtime = 0;
 263
 264                 /* It's a RAW disk image */
 265
 266                 if (!ret)
 267                         return 1;
 268
 269                 fd_getcrtime_at(dfd, filename, &crtime, 0);
 270
 271                 if (!pretty)
 272                         pretty = strndupa(filename, strlen(filename) - 4);
 273
 274                 r = image_new(IMAGE_RAW,
 275                               pretty,
 276                               path,
 277                               filename,
 278                               !(st.st_mode & 0222) || read_only,
 279                               crtime,
 280                               timespec_load(&st.st_mtim),
 281                               ret);
 282                 if (r < 0)
 283                         return r;
 284
 285                 (*ret)->usage = (*ret)->usage_exclusive = st.st_blocks * 512;
 286                 (*ret)->limit = (*ret)->limit_exclusive = st.st_size;
 287
 288                 return 1;
 289         }
 290
 291         return 0;
 292 }
 293
 294 int image_find(const char *name, Image **ret) {
 295         const char *path;
 296         int r;
 297
 298         assert(name);
 299
 300         /* There are no images with invalid names */
 301         if (!image_name_is_valid(name))
 302                 return 0;
 303
 304         NULSTR_FOREACH(path, image_search_path) {
 305                 _cleanup_closedir_ DIR *d = NULL;
 306
 307                 d = opendir(path);
 308                 if (!d) {
 309                         if (errno == ENOENT)
 310                                 continue;
 311
 312                         return -errno;
 313                 }
 314
 315                 r = image_make(NULL, dirfd(d), path, name, ret);
 316                 if (IN_SET(r, 0, -ENOENT)) {
 317                         _cleanup_free_ char *raw = NULL;
 318
 319                         raw = strappend(name, ".raw");
 320                         if (!raw)
 321                                 return -ENOMEM;
 322
 323                         r = image_make(NULL, dirfd(d), path, raw, ret);
 324                         if (IN_SET(r, 0, -ENOENT))
 325                                 continue;
 326                 }
 327                 if (r < 0)
 328                         return r;
 329
 330                 return 1;
 331         }
 332
 333         if (streq(name, ".host"))
 334                 return image_make(".host", AT_FDCWD, NULL, "/", ret);
 335
 336         return 0;
 337 };
 338
 339 int image_discover(Hashmap *h) {
 340         const char *path;
 341         int r;
 342
 343         assert(h);
 344
 345         NULSTR_FOREACH(path, image_search_path) {
 346                 _cleanup_closedir_ DIR *d = NULL;
 347                 struct dirent *de;
 348
 349                 d = opendir(path);
 350                 if (!d) {
 351                         if (errno == ENOENT)
 352                                 continue;
 353
 354                         return -errno;
 355                 }
 356
 357                 FOREACH_DIRENT_ALL(de, d, return -errno) {
 358                         _cleanup_(image_unrefp) Image *image = NULL;
 359
 360                         if (!image_name_is_valid(de->d_name))
 361                                 continue;
 362
 363                         if (hashmap_contains(h, de->d_name))
 364                                 continue;
 365
 366                         r = image_make(NULL, dirfd(d), path, de->d_name, &image);
 367                         if (IN_SET(r, 0, -ENOENT))
 368                                 continue;
 369                         if (r < 0)
 370                                 return r;
 371
 372                         r = hashmap_put(h, image->name, image);
 373                         if (r < 0)
 374                                 return r;
 375
 376                         image = NULL;
 377                 }
 378         }
 379
 380         if (!hashmap_contains(h, ".host")) {
 381                 _cleanup_(image_unrefp) Image *image = NULL;
 382
 383                 r = image_make(".host", AT_FDCWD, NULL, "/", &image);
 384                 if (r < 0)
 385                         return r;
 386
 387                 r = hashmap_put(h, image->name, image);
 388                 if (r < 0)
 389                         return r;
 390
 391                 image = NULL;
 392
 393         }
 394
 395         return 0;
 396 }
 397
 398 void image_hashmap_free(Hashmap *map) {
 399         Image *i;
 400
 401         while ((i = hashmap_steal_first(map)))
 402                 image_unref(i);
 403
 404         hashmap_free(map);
 405 }
 406
 407 int image_remove(Image *i) {
 408         _cleanup_release_lock_file_ LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT;
 409         _cleanup_strv_free_ char **settings = NULL;
 410         _cleanup_free_ char *roothash = NULL;
 411         char **j;
 412         int r;
 413
 414         assert(i);
 415
 416         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 417                 return -EROFS;
 418
 419         settings = image_settings_path(i);
 420         if (!settings)
 421                 return -ENOMEM;
 422
 423         roothash = image_roothash_path(i);
 424         if (!roothash)
 425                 return -ENOMEM;
 426
 427         /* Make sure we don't interfere with a running nspawn */
 428         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 429         if (r < 0)
 430                 return r;
 431
 432         switch (i->type) {
 433
 434         case IMAGE_SUBVOLUME:
 435                 r = btrfs_subvol_remove(i->path, BTRFS_REMOVE_RECURSIVE|BTRFS_REMOVE_QUOTA);
 436                 if (r < 0)
 437                         return r;
 438                 break;
 439
 440         case IMAGE_DIRECTORY:
 441                 /* Allow deletion of read-only directories */
 442                 (void) chattr_path(i->path, 0, FS_IMMUTABLE_FL);
 443                 r = rm_rf(i->path, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
 444                 if (r < 0)
 445                         return r;
 446
 447                 break;
 448
 449         case IMAGE_RAW:
 450                 if (unlink(i->path) < 0)
 451                         return -errno;
 452                 break;
 453
 454         default:
 455                 return -EOPNOTSUPP;
 456         }
 457
 458         STRV_FOREACH(j, settings) {
 459                 if (unlink(*j) < 0 && errno != ENOENT)
 460                         log_debug_errno(errno, "Failed to unlink %s, ignoring: %m", *j);
 461         }
 462
 463         if (unlink(roothash) < 0 && errno != ENOENT)
 464                 log_debug_errno(errno, "Failed to unlink %s, ignoring: %m", roothash);
 465
 466         return 0;
 467 }
 468
 469 static int rename_auxiliary_file(const char *path, const char *new_name, const char *suffix) {
 470         _cleanup_free_ char *rs = NULL;
 471         const char *fn;
 472
 473         fn = strjoina(new_name, suffix);
 474
 475         rs = file_in_same_dir(path, fn);
 476         if (!rs)
 477                 return -ENOMEM;
 478
 479         return rename_noreplace(AT_FDCWD, path, AT_FDCWD, rs);
 480 }
 481
 482 int image_rename(Image *i, const char *new_name) {
 483         _cleanup_release_lock_file_ LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT, name_lock = LOCK_FILE_INIT;
 484         _cleanup_free_ char *new_path = NULL, *nn = NULL, *roothash = NULL;
 485         _cleanup_strv_free_ char **settings = NULL;
 486         unsigned file_attr = 0;
 487         char **j;
 488         int r;
 489
 490         assert(i);
 491
 492         if (!image_name_is_valid(new_name))
 493                 return -EINVAL;
 494
 495         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 496                 return -EROFS;
 497
 498         settings = image_settings_path(i);
 499         if (!settings)
 500                 return -ENOMEM;
 501
 502         roothash = image_roothash_path(i);
 503         if (!roothash)
 504                 return -ENOMEM;
 505
 506         /* Make sure we don't interfere with a running nspawn */
 507         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 508         if (r < 0)
 509                 return r;
 510
 511         /* Make sure nobody takes the new name, between the time we
 512          * checked it is currently unused in all search paths, and the
 513          * time we take possession of it */
 514         r = image_name_lock(new_name, LOCK_EX|LOCK_NB, &name_lock);
 515         if (r < 0)
 516                 return r;
 517
 518         r = image_find(new_name, NULL);
 519         if (r < 0)
 520                 return r;
 521         if (r > 0)
 522                 return -EEXIST;
 523
 524         switch (i->type) {
 525
 526         case IMAGE_DIRECTORY:
 527                 /* Turn of the immutable bit while we rename the image, so that we can rename it */
 528                 (void) read_attr_path(i->path, &file_attr);
 529
 530                 if (file_attr & FS_IMMUTABLE_FL)
 531                         (void) chattr_path(i->path, 0, FS_IMMUTABLE_FL);
 532
 533                 /* fall through */
 534
 535         case IMAGE_SUBVOLUME:
 536                 new_path = file_in_same_dir(i->path, new_name);
 537                 break;
 538
 539         case IMAGE_RAW: {
 540                 const char *fn;
 541
 542                 fn = strjoina(new_name, ".raw");
 543                 new_path = file_in_same_dir(i->path, fn);
 544                 break;
 545         }
 546
 547         default:
 548                 return -EOPNOTSUPP;
 549         }
 550
 551         if (!new_path)
 552                 return -ENOMEM;
 553
 554         nn = strdup(new_name);
 555         if (!nn)
 556                 return -ENOMEM;
 557
 558         r = rename_noreplace(AT_FDCWD, i->path, AT_FDCWD, new_path);
 559         if (r < 0)
 560                 return r;
 561
 562         /* Restore the immutable bit, if it was set before */
 563         if (file_attr & FS_IMMUTABLE_FL)
 564                 (void) chattr_path(new_path, FS_IMMUTABLE_FL, FS_IMMUTABLE_FL);
 565
 566         free(i->path);
 567         i->path = new_path;
 568         new_path = NULL;
 569
 570         free(i->name);
 571         i->name = nn;
 572         nn = NULL;
 573
 574         STRV_FOREACH(j, settings) {
 575                 r = rename_auxiliary_file(*j, new_name, ".nspawn");
 576                 if (r < 0 && r != -ENOENT)
 577                         log_debug_errno(r, "Failed to rename settings file %s, ignoring: %m", *j);
 578         }
 579
 580         r = rename_auxiliary_file(roothash, new_name, ".roothash");
 581         if (r < 0 && r != -ENOENT)
 582                 log_debug_errno(r, "Failed to rename roothash file %s, ignoring: %m", roothash);
 583
 584         return 0;
 585 }
 586
 587 static int clone_auxiliary_file(const char *path, const char *new_name, const char *suffix) {
 588         _cleanup_free_ char *rs = NULL;
 589         const char *fn;
 590
 591         fn = strjoina(new_name, suffix);
 592
 593         rs = file_in_same_dir(path, fn);
 594         if (!rs)
 595                 return -ENOMEM;
 596
 597         return copy_file_atomic(path, rs, 0664, 0, COPY_REFLINK);
 598 }
 599
 600 int image_clone(Image *i, const char *new_name, bool read_only) {
 601         _cleanup_release_lock_file_ LockFile name_lock = LOCK_FILE_INIT;
 602         _cleanup_strv_free_ char **settings = NULL;
 603         _cleanup_free_ char *roothash = NULL;
 604         const char *new_path;
 605         char **j;
 606         int r;
 607
 608         assert(i);
 609
 610         if (!image_name_is_valid(new_name))
 611                 return -EINVAL;
 612
 613         settings = image_settings_path(i);
 614         if (!settings)
 615                 return -ENOMEM;
 616
 617         roothash = image_roothash_path(i);
 618         if (!roothash)
 619                 return -ENOMEM;
 620
 621         /* Make sure nobody takes the new name, between the time we
 622          * checked it is currently unused in all search paths, and the
 623          * time we take possession of it */
 624         r = image_name_lock(new_name, LOCK_EX|LOCK_NB, &name_lock);
 625         if (r < 0)
 626                 return r;
 627
 628         r = image_find(new_name, NULL);
 629         if (r < 0)
 630                 return r;
 631         if (r > 0)
 632                 return -EEXIST;
 633
 634         switch (i->type) {
 635
 636         case IMAGE_SUBVOLUME:
 637         case IMAGE_DIRECTORY:
 638                 /* If we can we'll always try to create a new btrfs subvolume here, even if the source is a plain
 639                  * directory. */
 640
 641                 new_path = strjoina("/var/lib/machines/", new_name);
 642
 643                 r = btrfs_subvol_snapshot(i->path, new_path,
 644                                           (read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
 645                                           BTRFS_SNAPSHOT_FALLBACK_COPY |
 646                                           BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
 647                                           BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
 648                                           BTRFS_SNAPSHOT_RECURSIVE |
 649                                           BTRFS_SNAPSHOT_QUOTA);
 650                 if (r >= 0)
 651                         /* Enable "subtree" quotas for the copy, if we didn't copy any quota from the source. */
 652                         (void) btrfs_subvol_auto_qgroup(new_path, 0, true);
 653
 654                 break;
 655
 656         case IMAGE_RAW:
 657                 new_path = strjoina("/var/lib/machines/", new_name, ".raw");
 658
 659                 r = copy_file_atomic(i->path, new_path, read_only ? 0444 : 0644, FS_NOCOW_FL, COPY_REFLINK);
 660                 break;
 661
 662         default:
 663                 return -EOPNOTSUPP;
 664         }
 665
 666         if (r < 0)
 667                 return r;
 668
 669         STRV_FOREACH(j, settings) {
 670                 r = clone_auxiliary_file(*j, new_name, ".nspawn");
 671                 if (r < 0 && r != -ENOENT)
 672                         log_debug_errno(r, "Failed to clone settings %s, ignoring: %m", *j);
 673         }
 674
 675         r = clone_auxiliary_file(roothash, new_name, ".roothash");
 676         if (r < 0 && r != -ENOENT)
 677                 log_debug_errno(r, "Failed to clone root hash file %s, ignoring: %m", roothash);
 678
 679         return 0;
 680 }
 681
 682 int image_read_only(Image *i, bool b) {
 683         _cleanup_release_lock_file_ LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT;
 684         int r;
 685         assert(i);
 686
 687         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 688                 return -EROFS;
 689
 690         /* Make sure we don't interfere with a running nspawn */
 691         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 692         if (r < 0)
 693                 return r;
 694
 695         switch (i->type) {
 696
 697         case IMAGE_SUBVOLUME:
 698
 699                 /* Note that we set the flag only on the top-level
 700                  * subvolume of the image. */
 701
 702                 r = btrfs_subvol_set_read_only(i->path, b);
 703                 if (r < 0)
 704                         return r;
 705
 706                 break;
 707
 708         case IMAGE_DIRECTORY:
 709                 /* For simple directory trees we cannot use the access
 710                    mode of the top-level directory, since it has an
 711                    effect on the container itself.  However, we can
 712                    use the "immutable" flag, to at least make the
 713                    top-level directory read-only. It's not as good as
 714                    a read-only subvolume, but at least something, and
 715                    we can read the value back. */
 716
 717                 r = chattr_path(i->path, b ? FS_IMMUTABLE_FL : 0, FS_IMMUTABLE_FL);
 718                 if (r < 0)
 719                         return r;
 720
 721                 break;
 722
 723         case IMAGE_RAW: {
 724                 struct stat st;
 725
 726                 if (stat(i->path, &st) < 0)
 727                         return -errno;
 728
 729                 if (chmod(i->path, (st.st_mode & 0444) | (b ? 0000 : 0200)) < 0)
 730                         return -errno;
 731
 732                 /* If the images is now read-only, it's a good time to
 733                  * defrag it, given that no write patterns will
 734                  * fragment it again. */
 735                 if (b)
 736                         (void) btrfs_defrag(i->path);
 737                 break;
 738         }
 739
 740         default:
 741                 return -EOPNOTSUPP;
 742         }
 743
 744         return 0;
 745 }
 746
 747 int image_path_lock(const char *path, int operation, LockFile *global, LockFile *local) {
 748         _cleanup_free_ char *p = NULL;
 749         LockFile t = LOCK_FILE_INIT;
 750         struct stat st;
 751         int r;
 752
 753         assert(path);
 754         assert(global);
 755         assert(local);
 756
 757         /* Locks an image path. This actually creates two locks: one
 758          * "local" one, next to the image path itself, which might be
 759          * shared via NFS. And another "global" one, in /run, that
 760          * uses the device/inode number. This has the benefit that we
 761          * can even lock a tree that is a mount point, correctly. */
 762
 763         if (!path_is_absolute(path))
 764                 return -EINVAL;
 765
 766         if (getenv_bool("SYSTEMD_NSPAWN_LOCK") == 0) {
 767                 *local = *global = (LockFile) LOCK_FILE_INIT;
 768                 return 0;
 769         }
 770
 771         if (path_equal(path, "/"))
 772                 return -EBUSY;
 773
 774         if (stat(path, &st) >= 0) {
 775                 if (asprintf(&p, "/run/systemd/nspawn/locks/inode-%lu:%lu", (unsigned long) st.st_dev, (unsigned long) st.st_ino) < 0)
 776                         return -ENOMEM;
 777         }
 778
 779         r = make_lock_file_for(path, operation, &t);
 780         if (r < 0)
 781                 return r;
 782
 783         if (p) {
 784                 mkdir_p("/run/systemd/nspawn/locks", 0700);
 785
 786                 r = make_lock_file(p, operation, global);
 787                 if (r < 0) {
 788                         release_lock_file(&t);
 789                         return r;
 790                 }
 791         } else
 792                 *global = (LockFile) LOCK_FILE_INIT;
 793
 794         *local = t;
 795         return 0;
 796 }
 797
 798 int image_set_limit(Image *i, uint64_t referenced_max) {
 799         assert(i);
 800
 801         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 802                 return -EROFS;
 803
 804         if (i->type != IMAGE_SUBVOLUME)
 805                 return -EOPNOTSUPP;
 806
 807         /* We set the quota both for the subvolume as well as for the
 808          * subtree. The latter is mostly for historical reasons, since
 809          * we didn't use to have a concept of subtree quota, and hence
 810          * only modified the subvolume quota. */
 811
 812         (void) btrfs_qgroup_set_limit(i->path, 0, referenced_max);
 813         (void) btrfs_subvol_auto_qgroup(i->path, 0, true);
 814         return btrfs_subvol_set_subtree_quota_limit(i->path, 0, referenced_max);
 815 }
 816
 817 int image_name_lock(const char *name, int operation, LockFile *ret) {
 818         const char *p;
 819
 820         assert(name);
 821         assert(ret);
 822
 823         /* Locks an image name, regardless of the precise path used. */
 824
 825         if (!image_name_is_valid(name))
 826                 return -EINVAL;
 827
 828         if (getenv_bool("SYSTEMD_NSPAWN_LOCK") == 0) {
 829                 *ret = (LockFile) LOCK_FILE_INIT;
 830                 return 0;
 831         }
 832
 833         if (streq(name, ".host"))
 834                 return -EBUSY;
 835
 836         mkdir_p("/run/systemd/nspawn/locks", 0700);
 837         p = strjoina("/run/systemd/nspawn/locks/name-", name);
 838
 839         return make_lock_file(p, operation, ret);
 840 }
 841
 842 bool image_name_is_valid(const char *s) {
 843         if (!filename_is_valid(s))
 844                 return false;
 845
 846         if (string_has_cc(s, NULL))
 847                 return false;
 848
 849         if (!utf8_is_valid(s))
 850                 return false;
 851
 852         /* Temporary files for atomically creating new files */
 853         if (startswith(s, ".#"))
 854                 return false;
 855
 856         return true;
 857 }
 858
 859 static const char* const image_type_table[_IMAGE_TYPE_MAX] = {
 860         [IMAGE_DIRECTORY] = "directory",
 861         [IMAGE_SUBVOLUME] = "subvolume",
 862         [IMAGE_RAW] = "raw",
 863 };
 864
 865 DEFINE_STRING_TABLE_LOOKUP(image_type, ImageType);