src/shared/switch-root.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <limits.h>
   6 #include <stdbool.h>
   7 #include <sys/mount.h>
   8 #include <sys/stat.h>
   9 #include <unistd.h>
  10
  11 #include "base-filesystem.h"
  12 #include "chase.h"
  13 #include "fd-util.h"
  14 #include "initrd-util.h"
  15 #include "log.h"
  16 #include "missing_syscall.h"
  17 #include "mkdir-label.h"
  18 #include "mount-util.h"
  19 #include "mountpoint-util.h"
  20 #include "path-util.h"
  21 #include "rm-rf.h"
  22 #include "stdio-util.h"
  23 #include "string-util.h"
  24 #include "strv.h"
  25 #include "switch-root.h"
  26 #include "user-util.h"
  27
  28 int switch_root(const char *new_root,
  29                 const char *old_root_after,   /* path below the new root, where to place the old root after the transition; may be NULL to unmount it */
  30                 unsigned long mount_flags) {  /* MS_MOVE or MS_BIND used for /proc/, /dev/, /run/, /sys/ */
  31
  32         _cleanup_close_ int old_root_fd = -EBADF, new_root_fd = -EBADF;
  33         _cleanup_free_ char *resolved_old_root_after = NULL;
  34         int r, istmp;
  35
  36         assert(new_root);
  37         assert(IN_SET(mount_flags, MS_MOVE, MS_BIND));
  38
  39         /* Check if we shall remove the contents of the old root */
  40         old_root_fd = open("/", O_DIRECTORY|O_CLOEXEC);
  41         if (old_root_fd < 0)
  42                 return log_error_errno(errno, "Failed to open root directory: %m");
  43
  44         new_root_fd = open(new_root, O_DIRECTORY|O_CLOEXEC);
  45         if (new_root_fd < 0)
  46                 return log_error_errno(errno, "Failed to open target directory '%s': %m", new_root);
  47
  48         r = files_same_at(old_root_fd, "", new_root_fd, "", AT_EMPTY_PATH);
  49         if (r < 0)
  50                 return log_error_errno(r, "Failed to determine if old and new root directory are the same: %m");
  51         if (r > 0) {
  52                 log_debug("Skipping switch root, as old and new root directory are the same.");
  53                 return 0;
  54         }
  55
  56         istmp = fd_is_temporary_fs(old_root_fd);
  57         if (istmp < 0)
  58                 return log_error_errno(istmp, "Failed to stat root directory: %m");
  59         if (istmp > 0)
  60                 log_debug("Root directory is on tmpfs, will do cleanup later.");
  61
  62         if (old_root_after) {
  63                 /* Determine where we shall place the old root after the transition */
  64                 r = chase(old_root_after, new_root, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &resolved_old_root_after, NULL);
  65                 if (r < 0)
  66                         return log_error_errno(r, "Failed to resolve %s/%s: %m", new_root, old_root_after);
  67                 if (r == 0) /* Doesn't exist yet. Let's create it */
  68                         (void) mkdir_p_label(resolved_old_root_after, 0755);
  69         }
  70
  71         /* We are about to unmount various file systems with MNT_DETACH (either explicitly via umount() or
  72          * indirectly via pivot_root()), and thus do not synchronously wait for them to be fully sync'ed —
  73          * all while making them invisible/inaccessible in the file system tree for later code. That makes
  74          * sync'ing them then difficult. Let's hence issue a manual sync() here, so that we at least can
  75          * guarantee all file systems are an a good state before entering this state. */
  76         sync();
  77
  78         /* Work-around for kernel design: the kernel refuses MS_MOVE if any file systems are mounted
  79          * MS_SHARED. Hence remount them MS_PRIVATE here as a work-around.
  80          *
  81          * https://bugzilla.redhat.com/show_bug.cgi?id=847418 */
  82         if (mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) < 0)
  83                 return log_error_errno(errno, "Failed to set \"/\" mount propagation to private: %m");
  84
  85         FOREACH_STRING(path, "/sys", "/dev", "/run", "/proc") {
  86                 _cleanup_free_ char *chased = NULL;
  87
  88                 r = chase(path, new_root, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &chased, NULL);
  89                 if (r < 0)
  90                         return log_error_errno(r, "Failed to resolve %s/%s: %m", new_root, path);
  91                 if (r > 0) {
  92                         /* Already exists. Let's see if it is a mount point already. */
  93                         r = path_is_mount_point(chased, NULL, 0);
  94                         if (r < 0)
  95                                 return log_error_errno(r, "Failed to determine whether %s is a mount point: %m", chased);
  96                         if (r > 0) /* If it is already mounted, then do nothing */
  97                                 continue;
  98                 } else
  99                          /* Doesn't exist yet? */
 100                         (void) mkdir_p_label(chased, 0755);
 101
 102                 if (mount(path, chased, NULL, mount_flags, NULL) < 0)
 103                         return log_error_errno(errno, "Failed to mount %s to %s: %m", path, chased);
 104         }
 105
 106         /* Do not fail if base_filesystem_create() fails. Not all switch roots are like base_filesystem_create() wants
 107          * them to look like. They might even boot, if they are RO and don't have the FS layout. Just ignore the error
 108          * and switch_root() nevertheless. */
 109         (void) base_filesystem_create_fd(new_root_fd, new_root, UID_INVALID, GID_INVALID);
 110
 111         if (fchdir(new_root_fd) < 0)
 112                 return log_error_errno(errno, "Failed to change directory to %s: %m", new_root);
 113
 114         /* We first try a pivot_root() so that we can umount the old root dir. In many cases (i.e. where rootfs is /),
 115          * that's not possible however, and hence we simply overmount root */
 116         if (resolved_old_root_after)
 117                 r = RET_NERRNO(pivot_root(".", resolved_old_root_after));
 118         else {
 119                 r = RET_NERRNO(pivot_root(".", "."));
 120                 if (r >= 0) {
 121                         /* Now unmount the upper of the two stacked file systems */
 122                         if (umount2(".", MNT_DETACH) < 0)
 123                                 return log_error_errno(errno, "Failed to unmount the old root: %m");
 124                 }
 125         }
 126         if (r < 0) {
 127                 log_debug_errno(r, "Pivoting root file system failed, moving mounts instead: %m");
 128
 129                 /* If we have to use MS_MOVE let's first try to get rid of *all* mounts we can, with the
 130                  * exception of the path we want to switch to, plus everything leading to it and within
 131                  * it. This is necessary because unlike pivot_root() just moving the mount to the root via
 132                  * MS_MOVE won't magically unmount anything below it. Once the chroot() succeeds the mounts
 133                  * below would still be around but invisible to us, because not accessible via
 134                  * /proc/self/mountinfo. Hence, let's clean everything up first, as long as we still can. */
 135                 (void) umount_recursive_full(NULL, MNT_DETACH, STRV_MAKE(new_root));
 136
 137                 if (mount(".", "/", NULL, MS_MOVE, NULL) < 0)
 138                         return log_error_errno(errno, "Failed to move %s to /: %m", new_root);
 139
 140                 if (chroot(".") < 0)
 141                         return log_error_errno(errno, "Failed to change root: %m");
 142
 143                 if (chdir(".") < 0)
 144                         return log_error_errno(errno, "Failed to change directory: %m");
 145         }
 146
 147         if (istmp) {
 148                 struct stat rb;
 149
 150                 if (fstat(old_root_fd, &rb) < 0)
 151                         return log_error_errno(errno, "Failed to stat old root directory: %m");
 152
 153                 /* Note: the below won't operate on non-memory file systems (i.e. only on tmpfs, ramfs), and
 154                  * it will stop at mount boundaries */
 155                 (void) rm_rf_children(TAKE_FD(old_root_fd), 0, &rb); /* takes possession of the dir fd, even on failure */
 156         }
 157
 158         return 0;
 159 }