src/shared/switch-root.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <limits.h>
   6 #include <stdbool.h>
   7 #include <sys/mount.h>
   8 #include <sys/stat.h>
   9 #include <unistd.h>
  10
  11 #include "base-filesystem.h"
  12 #include "chase.h"
  13 #include "creds-util.h"
  14 #include "fd-util.h"
  15 #include "initrd-util.h"
  16 #include "log.h"
  17 #include "missing_syscall.h"
  18 #include "mkdir-label.h"
  19 #include "mount-util.h"
  20 #include "mountpoint-util.h"
  21 #include "path-util.h"
  22 #include "rm-rf.h"
  23 #include "stdio-util.h"
  24 #include "string-util.h"
  25 #include "strv.h"
  26 #include "switch-root.h"
  27 #include "user-util.h"
  28
  29 int switch_root(const char *new_root,
  30                 const char *old_root_after,   /* path below the new root, where to place the old root after the transition; may be NULL to unmount it */
  31                 SwitchRootFlags flags) {
  32
  33         /* Stuff mounted below /run/ we don't save on soft reboot, as it might have lost its relevance,
  34          * e.g. removable media and such. We rather want that the new boot mounts this fresh. But on
  35          * the switch from initrd we do use MS_REC, as it is expected that mounts set up in /run/ are
  36          * maintained. */
  37         static const struct {
  38                 const char *path;
  39                 unsigned long mount_flags;                 /* Flags to apply if SWITCH_ROOT_RECURSIVE_RUN is unset */
  40                 unsigned long mount_flags_recursive_run;   /* Flags to apply if SWITCH_ROOT_RECURSIVE_RUN is set (0 if shall be skipped) */
  41         } transfer_table[] = {
  42                 { "/dev",             MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Recursive, because we want to save the original /dev/shm/ + /dev/pts/ and similar */
  43                 { "/sys",             MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Similar, we want to retain various API VFS, or the cgroupv1 /sys/fs/cgroup/ tree */
  44                 { "/proc",            MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Similar */
  45                 { "/run",             MS_BIND,         MS_BIND|MS_REC }, /* Recursive except on soft reboot, see above */
  46                 { "/run/credentials", MS_BIND|MS_REC,  0 /* skip! */  }, /* Credential mounts should survive */
  47                 { "/run/host",        MS_BIND|MS_REC,  0 /* skip! */  }, /* Host supplied hierarchy should also survive */
  48         };
  49
  50         _cleanup_close_ int old_root_fd = -EBADF, new_root_fd = -EBADF;
  51         _cleanup_free_ char *resolved_old_root_after = NULL;
  52         int r, istmp;
  53
  54         assert(new_root);
  55
  56         /* Check if we shall remove the contents of the old root */
  57         old_root_fd = open("/", O_DIRECTORY|O_CLOEXEC);
  58         if (old_root_fd < 0)
  59                 return log_error_errno(errno, "Failed to open root directory: %m");
  60
  61         new_root_fd = open(new_root, O_DIRECTORY|O_CLOEXEC);
  62         if (new_root_fd < 0)
  63                 return log_error_errno(errno, "Failed to open target directory '%s': %m", new_root);
  64
  65         r = fds_are_same_mount(old_root_fd, new_root_fd);
  66         if (r < 0)
  67                 return log_error_errno(r, "Failed to check if old and new root directory/mount are the same: %m");
  68         if (r > 0) {
  69                 log_debug("Skipping switch root, as old and new root directories/mounts are the same.");
  70                 return 0;
  71         }
  72
  73         /* Make the new root directory a mount point if it isn't */
  74         r = fd_make_mount_point(new_root_fd);
  75         if (r < 0)
  76                 return log_error_errno(r, "Failed to make new root directory a mount point: %m");
  77         if (r > 0) {
  78                 int fd;
  79
  80                 /* When the path was not a mount point, then we need to reopen the path, otherwise, it still
  81                  * points to the underlying directory. */
  82
  83                 fd = open(new_root, O_DIRECTORY|O_CLOEXEC);
  84                 if (fd < 0)
  85                         return log_error_errno(errno, "Failed to reopen target directory '%s': %m", new_root);
  86
  87                 close_and_replace(new_root_fd, fd);
  88         }
  89
  90         if (FLAGS_SET(flags, SWITCH_ROOT_DESTROY_OLD_ROOT)) {
  91                 istmp = fd_is_temporary_fs(old_root_fd);
  92                 if (istmp < 0)
  93                         return log_error_errno(istmp, "Failed to stat root directory: %m");
  94                 if (istmp > 0)
  95                         log_debug("Root directory is on tmpfs, will do cleanup later.");
  96         } else
  97                 istmp = -1; /* don't know */
  98
  99         if (old_root_after) {
 100                 /* Determine where we shall place the old root after the transition */
 101                 r = chase(old_root_after, new_root, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &resolved_old_root_after, NULL);
 102                 if (r < 0)
 103                         return log_error_errno(r, "Failed to resolve %s/%s: %m", new_root, old_root_after);
 104                 if (r == 0) /* Doesn't exist yet. Let's create it */
 105                         (void) mkdir_p_label(resolved_old_root_after, 0755);
 106         }
 107
 108         /* We are about to unmount various file systems with MNT_DETACH (either explicitly via umount() or
 109          * indirectly via pivot_root()), and thus do not synchronously wait for them to be fully sync'ed —
 110          * all while making them invisible/inaccessible in the file system tree for later code. That makes
 111          * sync'ing them then difficult. Let's hence issue a manual sync() here, so that we at least can
 112          * guarantee all file systems are an a good state before entering this state. */
 113         if (!FLAGS_SET(flags, SWITCH_ROOT_DONT_SYNC))
 114                 sync();
 115
 116         /* Work-around for kernel design: the kernel refuses MS_MOVE if any file systems are mounted
 117          * MS_SHARED. Hence remount them MS_PRIVATE here as a work-around.
 118          *
 119          * https://bugzilla.redhat.com/show_bug.cgi?id=847418 */
 120         if (mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) < 0)
 121                 return log_error_errno(errno, "Failed to set \"/\" mount propagation to private: %m");
 122
 123         /* Do not fail if base_filesystem_create() fails. Not all switch roots are like base_filesystem_create() wants
 124          * them to look like. They might even boot, if they are RO and don't have the FS layout. Just ignore the error
 125          * and switch_root() nevertheless. */
 126         (void) base_filesystem_create_fd(new_root_fd, new_root, UID_INVALID, GID_INVALID);
 127
 128         FOREACH_ELEMENT(transfer, transfer_table) {
 129                 _cleanup_free_ char *chased = NULL;
 130                 unsigned long mount_flags;
 131
 132                 mount_flags = FLAGS_SET(flags, SWITCH_ROOT_RECURSIVE_RUN) ? transfer->mount_flags_recursive_run : transfer->mount_flags;
 133                 if (mount_flags == 0) /* skip if zero */
 134                         continue;
 135
 136                 if (access(transfer->path, F_OK) < 0) {
 137                         log_debug_errno(errno, "Path '%s' to move to target root directory, not found, ignoring: %m", transfer->path);
 138                         continue;
 139                 }
 140
 141                 r = chase(transfer->path, new_root, CHASE_PREFIX_ROOT, &chased, NULL);
 142                 if (r < 0)
 143                         return log_error_errno(r, "Failed to resolve %s/%s: %m", new_root, transfer->path);
 144
 145                 /* Let's see if it is a mount point already. */
 146                 r = path_is_mount_point(chased);
 147                 if (r < 0)
 148                         return log_error_errno(r, "Failed to determine whether %s is a mount point: %m", chased);
 149                 if (r > 0) /* If it is already mounted, then do nothing */
 150                         continue;
 151
 152                 r = mount_nofollow_verbose(LOG_ERR, transfer->path, chased, NULL, mount_flags, NULL);
 153                 if (r < 0)
 154                         return r;
 155         }
 156
 157         if (fchdir(new_root_fd) < 0)
 158                 return log_error_errno(errno, "Failed to change directory to %s: %m", new_root);
 159
 160         /* We first try a pivot_root() so that we can umount the old root dir. In many cases (i.e. where rootfs is /),
 161          * that's not possible however, and hence we simply overmount root */
 162         if (resolved_old_root_after)
 163                 r = RET_NERRNO(pivot_root(".", resolved_old_root_after));
 164         else {
 165                 r = RET_NERRNO(pivot_root(".", "."));
 166                 if (r >= 0) {
 167                         /* Now unmount the upper of the two stacked file systems */
 168                         if (umount2(".", MNT_DETACH) < 0)
 169                                 return log_error_errno(errno, "Failed to unmount the old root: %m");
 170                 }
 171         }
 172         if (r < 0) {
 173                 log_debug_errno(r, "Pivoting root file system failed, moving mounts instead: %m");
 174
 175                 if (resolved_old_root_after) {
 176                         r = mount_nofollow_verbose(LOG_ERR, "/", resolved_old_root_after, NULL, MS_BIND|MS_REC, NULL);
 177                         if (r < 0)
 178                                 return r;
 179                 }
 180
 181                 /* If we have to use MS_MOVE let's first try to get rid of *all* mounts we can, with the
 182                  * exception of the path we want to switch to, plus everything leading to it and within
 183                  * it. This is necessary because unlike pivot_root() just moving the mount to the root via
 184                  * MS_MOVE won't magically unmount anything below it. Once the chroot() succeeds the mounts
 185                  * below would still be around but invisible to us, because not accessible via
 186                  * /proc/self/mountinfo. Hence, let's clean everything up first, as long as we still can. */
 187                 (void) umount_recursive_full(NULL, MNT_DETACH, STRV_MAKE(new_root));
 188
 189                 if (mount(".", "/", NULL, MS_MOVE, NULL) < 0)
 190                         return log_error_errno(errno, "Failed to move %s to /: %m", new_root);
 191
 192                 if (chroot(".") < 0)
 193                         return log_error_errno(errno, "Failed to change root: %m");
 194
 195                 if (chdir(".") < 0)
 196                         return log_error_errno(errno, "Failed to change directory: %m");
 197         }
 198
 199         if (istmp > 0) {
 200                 struct stat rb;
 201
 202                 if (fstat(old_root_fd, &rb) < 0)
 203                         return log_error_errno(errno, "Failed to stat old root directory: %m");
 204
 205                 /* Note: the below won't operate on non-memory file systems (i.e. only on tmpfs, ramfs), and
 206                  * it will stop at mount boundaries */
 207                 (void) rm_rf_children(TAKE_FD(old_root_fd), 0, &rb); /* takes possession of the dir fd, even on failure */
 208         }
 209
 210         return 0;
 211 }