src/sysext/sysext.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <fcntl.h>
   4 #include <getopt.h>
   5 #include <linux/loop.h>
   6 #include <sys/mount.h>
   7 #include <unistd.h>
   8
   9 #include "capability-util.h"
  10 #include "chase-symlinks.h"
  11 #include "discover-image.h"
  12 #include "dissect-image.h"
  13 #include "env-util.h"
  14 #include "escape.h"
  15 #include "extension-release.h"
  16 #include "fd-util.h"
  17 #include "fileio.h"
  18 #include "format-table.h"
  19 #include "fs-util.h"
  20 #include "hashmap.h"
  21 #include "log.h"
  22 #include "main-func.h"
  23 #include "missing_magic.h"
  24 #include "mkdir.h"
  25 #include "mount-util.h"
  26 #include "mountpoint-util.h"
  27 #include "os-util.h"
  28 #include "pager.h"
  29 #include "parse-argument.h"
  30 #include "parse-util.h"
  31 #include "pretty-print.h"
  32 #include "process-util.h"
  33 #include "sort-util.h"
  34 #include "stat-util.h"
  35 #include "terminal-util.h"
  36 #include "user-util.h"
  37 #include "verbs.h"
  38
  39 static char **arg_hierarchies = NULL; /* "/usr" + "/opt" by default */
  40 static char *arg_root = NULL;
  41 static JsonFormatFlags arg_json_format_flags = JSON_FORMAT_OFF;
  42 static PagerFlags arg_pager_flags = 0;
  43 static bool arg_legend = true;
  44 static bool arg_force = false;
  45
  46 STATIC_DESTRUCTOR_REGISTER(arg_hierarchies, strv_freep);
  47 STATIC_DESTRUCTOR_REGISTER(arg_root, freep);
  48
  49 static int is_our_mount_point(const char *p) {
  50         _cleanup_free_ char *buf = NULL, *f = NULL;
  51         struct stat st;
  52         dev_t dev;
  53         int r;
  54
  55         r = path_is_mount_point(p, NULL, 0);
  56         if (r == -ENOENT) {
  57                 log_debug_errno(r, "Hierarchy '%s' doesn't exist.", p);
  58                 return false;
  59         }
  60         if (r < 0)
  61                 return log_error_errno(r, "Failed to determine whether '%s' is a mount point: %m", p);
  62         if (r == 0) {
  63                 log_debug("Hierarchy '%s' is not a mount point, skipping.", p);
  64                 return false;
  65         }
  66
  67         /* So we know now that it's a mount point. Now let's check if it's one of ours, so that we don't
  68          * accidentally unmount the user's own /usr/ but just the mounts we established ourselves. We do this
  69          * check by looking into the metadata directory we place in merged mounts: if the file
  70          * .systemd-sysext/dev contains the major/minor device pair of the mount we have a good reason to
  71          * believe this is one of our mounts. This thorough check has the benefit that we aren't easily
  72          * confused if people tar up one of our merged trees and untar them elsewhere where we might mistake
  73          * them for a live sysext tree. */
  74
  75         f = path_join(p, ".systemd-sysext/dev");
  76         if (!f)
  77                 return log_oom();
  78
  79         r = read_one_line_file(f, &buf);
  80         if (r == -ENOENT) {
  81                 log_debug("Hierarchy '%s' does not carry a .systemd-sysext/dev file, not a sysext merged tree.", p);
  82                 return false;
  83         }
  84         if (r < 0)
  85                 return log_error_errno(r, "Failed to determine whether hierarchy '%s' contains '.systemd-sysext/dev': %m", p);
  86
  87         r = parse_dev(buf, &dev);
  88         if (r < 0)
  89                 return log_error_errno(r, "Failed to parse device major/minor stored in '.systemd-sysext/dev' file on '%s': %m", p);
  90
  91         if (lstat(p, &st) < 0)
  92                 return log_error_errno(r, "Failed to stat %s: %m", p);
  93
  94         if (st.st_dev != dev) {
  95                 log_debug("Hierarchy '%s' reports a different device major/minor than what we are seeing, assuming offline copy.", p);
  96                 return false;
  97         }
  98
  99         return true;
 100 }
 101
 102 static int unmerge_hierarchy(const char *p) {
 103         int r;
 104
 105         for (;;) {
 106                 /* We only unmount /usr/ if it is a mount point and really one of ours, in order not to break
 107                  * systems where /usr/ is a mount point of its own already. */
 108
 109                 r = is_our_mount_point(p);
 110                 if (r < 0)
 111                         return r;
 112                 if (r == 0)
 113                         break;
 114
 115                 r = umount_verbose(LOG_ERR, p, MNT_DETACH|UMOUNT_NOFOLLOW);
 116                 if (r < 0)
 117                         return log_error_errno(r, "Failed to unmount file system '%s': %m", p);
 118
 119                 log_info("Unmerged '%s'.", p);
 120         }
 121
 122         return 0;
 123 }
 124
 125 static int unmerge(void) {
 126         int r, ret = 0;
 127
 128         STRV_FOREACH(p, arg_hierarchies) {
 129                 _cleanup_free_ char *resolved = NULL;
 130
 131                 r = chase_symlinks(*p, arg_root, CHASE_PREFIX_ROOT, &resolved, NULL);
 132                 if (r == -ENOENT) {
 133                         log_debug_errno(r, "Hierarchy '%s%s' does not exist, ignoring.", strempty(arg_root), *p);
 134                         continue;
 135                 }
 136                 if (r < 0) {
 137                         log_error_errno(r, "Failed to resolve path to hierarchy '%s%s': %m", strempty(arg_root), *p);
 138                         if (ret == 0)
 139                                 ret = r;
 140
 141                         continue;
 142                 }
 143
 144                 r = unmerge_hierarchy(resolved);
 145                 if (r < 0 && ret == 0)
 146                         ret = r;
 147         }
 148
 149         return ret;
 150 }
 151
 152 static int verb_unmerge(int argc, char **argv, void *userdata) {
 153
 154         if (!have_effective_cap(CAP_SYS_ADMIN))
 155                 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Need to be privileged.");
 156
 157         return unmerge();
 158 }
 159
 160 static int verb_status(int argc, char **argv, void *userdata) {
 161         _cleanup_(table_unrefp) Table *t = NULL;
 162         int r, ret = 0;
 163
 164         t = table_new("hierarchy", "extensions", "since");
 165         if (!t)
 166                 return log_oom();
 167
 168         (void) table_set_empty_string(t, "-");
 169
 170         STRV_FOREACH(p, arg_hierarchies) {
 171                 _cleanup_free_ char *resolved = NULL, *f = NULL, *buf = NULL;
 172                 _cleanup_strv_free_ char **l = NULL;
 173                 struct stat st;
 174
 175                 r = chase_symlinks(*p, arg_root, CHASE_PREFIX_ROOT, &resolved, NULL);
 176                 if (r == -ENOENT) {
 177                         log_debug_errno(r, "Hierarchy '%s%s' does not exist, ignoring.", strempty(arg_root), *p);
 178                         continue;
 179                 }
 180                 if (r < 0) {
 181                         log_error_errno(r, "Failed to resolve path to hierarchy '%s%s': %m", strempty(arg_root), *p);
 182                         goto inner_fail;
 183                 }
 184
 185                 r = is_our_mount_point(resolved);
 186                 if (r < 0)
 187                         goto inner_fail;
 188                 if (r == 0) {
 189                         r = table_add_many(
 190                                         t,
 191                                         TABLE_PATH, *p,
 192                                         TABLE_STRING, "none",
 193                                         TABLE_SET_COLOR, ansi_grey(),
 194                                         TABLE_EMPTY);
 195                         if (r < 0)
 196                                 return table_log_add_error(r);
 197
 198                         continue;
 199                 }
 200
 201                 f = path_join(*p, ".systemd-sysext/extensions");
 202                 if (!f)
 203                         return log_oom();
 204
 205                 r = read_full_file(f, &buf, NULL);
 206                 if (r < 0)
 207                         return log_error_errno(r, "Failed to open '%s': %m", f);
 208
 209                 l = strv_split_newlines(buf);
 210                 if (!l)
 211                         return log_oom();
 212
 213                 if (stat(*p, &st) < 0)
 214                         return log_error_errno(r, "Failed to stat() '%s': %m", *p);
 215
 216                 r = table_add_many(
 217                                 t,
 218                                 TABLE_PATH, *p,
 219                                 TABLE_STRV, l,
 220                                 TABLE_TIMESTAMP, timespec_load(&st.st_mtim));
 221                 if (r < 0)
 222                         return table_log_add_error(r);
 223
 224                 continue;
 225
 226         inner_fail:
 227                 if (ret == 0)
 228                         ret = r;
 229         }
 230
 231         (void) table_set_sort(t, (size_t) 0);
 232
 233         r = table_print_with_pager(t, arg_json_format_flags, arg_pager_flags, arg_legend);
 234         if (r < 0)
 235                 return r;
 236
 237         return ret;
 238 }
 239
 240 static int mount_overlayfs(
 241                 const char *where,
 242                 char **layers) {
 243
 244         _cleanup_free_ char *options = NULL;
 245         bool separator = false;
 246         int r;
 247
 248         assert(where);
 249
 250         options = strdup("lowerdir=");
 251         if (!options)
 252                 return log_oom();
 253
 254         STRV_FOREACH(l, layers) {
 255                 _cleanup_free_ char *escaped = NULL;
 256
 257                 escaped = shell_escape(*l, ",:");
 258                 if (!escaped)
 259                         return log_oom();
 260
 261                 if (!strextend(&options, separator ? ":" : "", escaped))
 262                         return log_oom();
 263
 264                 separator = true;
 265         }
 266
 267         /* Now mount the actual overlayfs */
 268         r = mount_nofollow_verbose(LOG_ERR, "sysext", where, "overlay", MS_RDONLY, options);
 269         if (r < 0)
 270                 return r;
 271
 272         return 0;
 273 }
 274
 275 static int merge_hierarchy(
 276                 const char *hierarchy,
 277                 char **extensions,
 278                 char **paths,
 279                 const char *meta_path,
 280                 const char *overlay_path) {
 281
 282         _cleanup_free_ char *resolved_hierarchy = NULL, *f = NULL, *buf = NULL;
 283         _cleanup_strv_free_ char **layers = NULL;
 284         struct stat st;
 285         int r;
 286
 287         assert(hierarchy);
 288         assert(meta_path);
 289         assert(overlay_path);
 290
 291         /* Resolve the path of the host's version of the hierarchy, i.e. what we want to use as lowest layer
 292          * in the overlayfs stack. */
 293         r = chase_symlinks(hierarchy, arg_root, CHASE_PREFIX_ROOT, &resolved_hierarchy, NULL);
 294         if (r == -ENOENT)
 295                 log_debug_errno(r, "Hierarchy '%s' on host doesn't exist, not merging.", hierarchy);
 296         else if (r < 0)
 297                 return log_error_errno(r, "Failed to resolve host hierarchy '%s': %m", hierarchy);
 298         else {
 299                 r = dir_is_empty(resolved_hierarchy);
 300                 if (r < 0)
 301                         return log_error_errno(r, "Failed to check if host hierarchy '%s' is empty: %m", resolved_hierarchy);
 302                 if (r > 0) {
 303                         log_debug("Host hierarchy '%s' is empty, not merging.", resolved_hierarchy);
 304                         resolved_hierarchy = mfree(resolved_hierarchy);
 305                 }
 306         }
 307
 308         /* Let's generate a metadata file that lists all extensions we took into account for this
 309          * hierarchy. We include this in the final fs, to make things nicely discoverable and
 310          * recognizable. */
 311         f = path_join(meta_path, ".systemd-sysext/extensions");
 312         if (!f)
 313                 return log_oom();
 314
 315         buf = strv_join(extensions, "\n");
 316         if (!buf)
 317                 return log_oom();
 318
 319         r = write_string_file(f, buf, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_MKDIR_0755);
 320         if (r < 0)
 321                 return log_error_errno(r, "Failed to write extension meta file '%s': %m", f);
 322
 323         /* Put the meta path (i.e. our synthesized stuff) at the top of the layer stack */
 324         layers = strv_new(meta_path);
 325         if (!layers)
 326                 return log_oom();
 327
 328         /* Put the extensions in the middle */
 329         STRV_FOREACH(p, paths) {
 330                 _cleanup_free_ char *resolved = NULL;
 331
 332                 r = chase_symlinks(hierarchy, *p, CHASE_PREFIX_ROOT, &resolved, NULL);
 333                 if (r == -ENOENT) {
 334                         log_debug_errno(r, "Hierarchy '%s' in extension '%s' doesn't exist, not merging.", hierarchy, *p);
 335                         continue;
 336                 }
 337                 if (r < 0)
 338                         return log_error_errno(r, "Failed to resolve hierarchy '%s' in extension '%s': %m", hierarchy, *p);
 339
 340                 r = dir_is_empty(resolved);
 341                 if (r < 0)
 342                         return log_error_errno(r, "Failed to check if hierarchy '%s' in extension '%s' is empty: %m", resolved, *p);
 343                 if (r > 0) {
 344                         log_debug("Hierarchy '%s' in extension '%s' is empty, not merging.", hierarchy, *p);
 345                         continue;
 346                 }
 347
 348                 r = strv_consume(&layers, TAKE_PTR(resolved));
 349                 if (r < 0)
 350                         return log_oom();
 351         }
 352
 353         if (!layers[1]) /* No extension with files in this hierarchy? Then don't do anything. */
 354                 return 0;
 355
 356         if (resolved_hierarchy) {
 357                 /* Add the host hierarchy as last (lowest) layer in the stack */
 358                 r = strv_consume(&layers, TAKE_PTR(resolved_hierarchy));
 359                 if (r < 0)
 360                         return log_oom();
 361         }
 362
 363         r = mkdir_p(overlay_path, 0700);
 364         if (r < 0)
 365                 return log_error_errno(r, "Failed to make directory '%s': %m", overlay_path);
 366
 367         r = mount_overlayfs(overlay_path, layers);
 368         if (r < 0)
 369                 return r;
 370
 371         /* The overlayfs superblock is read-only. Let's also mark the bind mount read-only. Extra turbo safety 😎 */
 372         r = bind_remount_recursive(overlay_path, MS_RDONLY, MS_RDONLY, NULL);
 373         if (r < 0)
 374                 return log_error_errno(r, "Failed to make bind mount '%s' read-only: %m", overlay_path);
 375
 376         /* Now we have mounted the new file system. Let's now figure out its .st_dev field, and make that
 377          * available in the metadata directory. This is useful to detect whether the metadata dir actually
 378          * belongs to the fs it is found on: if .st_dev of the top-level mount matches it, it's pretty likely
 379          * we are looking at a live sysext tree, and not an unpacked tar or so of one. */
 380         if (stat(overlay_path, &st) < 0)
 381                 return log_error_errno(r, "Failed to stat mount '%s': %m", overlay_path);
 382
 383         free(f);
 384         f = path_join(meta_path, ".systemd-sysext/dev");
 385         if (!f)
 386                 return log_oom();
 387
 388         r = write_string_filef(f, WRITE_STRING_FILE_CREATE, "%u:%u", major(st.st_dev), minor(st.st_dev));
 389         if (r < 0)
 390                 return log_error_errno(r, "Failed to write '%s': %m", f);
 391
 392         /* Make sure the top-level dir has an mtime marking the point we established the merge */
 393         if (utimensat(AT_FDCWD, meta_path, NULL, AT_SYMLINK_NOFOLLOW) < 0)
 394                 return log_error_errno(r, "Failed fix mtime of '%s': %m", meta_path);
 395
 396         return 1;
 397 }
 398
 399 static int strverscmp_improvedp(char *const* a, char *const* b) {
 400         /* usable in qsort() for sorting a string array with strverscmp_improved() */
 401         return strverscmp_improved(*a, *b);
 402 }
 403
 404 static int validate_version(
 405                 const char *root,
 406                 const Image *img,
 407                 const char *host_os_release_id,
 408                 const char *host_os_release_version_id,
 409                 const char *host_os_release_sysext_level) {
 410
 411         int r;
 412
 413         assert(root);
 414         assert(img);
 415
 416         if (arg_force) {
 417                 log_debug("Force mode enabled, skipping version validation.");
 418                 return 1;
 419         }
 420
 421         /* Insist that extension images do not overwrite the underlying OS release file (it's fine if
 422          * they place one in /etc/os-release, i.e. where things don't matter, as they aren't
 423          * merged.) */
 424         r = chase_symlinks("/usr/lib/os-release", root, CHASE_PREFIX_ROOT, NULL, NULL);
 425         if (r < 0) {
 426                 if (r != -ENOENT)
 427                         return log_error_errno(r, "Failed to determine whether /usr/lib/os-release exists in the extension image: %m");
 428         } else
 429                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 430                                        "Extension image contains /usr/lib/os-release file, which is not allowed (it may carry /etc/os-release), refusing.");
 431
 432         r = extension_release_validate(
 433                         img->name,
 434                         host_os_release_id,
 435                         host_os_release_version_id,
 436                         host_os_release_sysext_level,
 437                         in_initrd() ? "initrd" : "system",
 438                         img->extension_release);
 439         if (r < 0)
 440                 return log_error_errno(r, "Failed to validate extension release information: %m");
 441
 442         return r;
 443 }
 444
 445 static int merge_subprocess(Hashmap *images, const char *workspace) {
 446         _cleanup_free_ char *host_os_release_id = NULL, *host_os_release_version_id = NULL, *host_os_release_sysext_level = NULL,
 447                 *buf = NULL;
 448         _cleanup_strv_free_ char **extensions = NULL, **paths = NULL;
 449         size_t n_extensions = 0;
 450         unsigned n_ignored = 0;
 451         Image *img;
 452         int r;
 453
 454         /* Mark the whole of /run as MS_SLAVE, so that we can mount stuff below it that doesn't show up on
 455          * the host otherwise. */
 456         r = mount_nofollow_verbose(LOG_ERR, NULL, "/run", NULL, MS_SLAVE|MS_REC, NULL);
 457         if (r < 0)
 458                 return log_error_errno(r, "Failed to remount /run/ MS_SLAVE: %m");
 459
 460         /* Let's create the workspace if it's missing */
 461         r = mkdir_p(workspace, 0700);
 462         if (r < 0)
 463                 return log_error_errno(r, "Failed to create /run/systemd/sysext: %m");
 464
 465         /* Let's mount a tmpfs to our workspace. This way we don't need to clean up the inodes we mount over,
 466          * but let the kernel do that entirely automatically, once our namespace dies. Note that this file
 467          * system won't be visible to anyone but us, since we opened our own namespace and then made the
 468          * /run/ hierarchy (which our workspace is contained in) MS_SLAVE, see above. */
 469         r = mount_nofollow_verbose(LOG_ERR, "sysext", workspace, "tmpfs", 0, "mode=0700");
 470         if (r < 0)
 471                 return r;
 472
 473         /* Acquire host OS release info, so that we can compare it with the extension's data */
 474         r = parse_os_release(
 475                         arg_root,
 476                         "ID", &host_os_release_id,
 477                         "VERSION_ID", &host_os_release_version_id,
 478                         "SYSEXT_LEVEL", &host_os_release_sysext_level);
 479         if (r < 0)
 480                 return log_error_errno(r, "Failed to acquire 'os-release' data of OS tree '%s': %m", empty_to_root(arg_root));
 481
 482         /* Let's now mount all images */
 483         HASHMAP_FOREACH(img, images) {
 484                 _cleanup_free_ char *p = NULL;
 485
 486                 p = path_join(workspace, "extensions", img->name);
 487                 if (!p)
 488                         return log_oom();
 489
 490                 r = mkdir_p(p, 0700);
 491                 if (r < 0)
 492                         return log_error_errno(r, "Failed to create %s: %m", p);
 493
 494                 switch (img->type) {
 495                 case IMAGE_DIRECTORY:
 496                 case IMAGE_SUBVOLUME:
 497                         r = mount_nofollow_verbose(LOG_ERR, img->path, p, NULL, MS_BIND, NULL);
 498                         if (r < 0)
 499                                 return r;
 500
 501                         /* Make this a read-only bind mount */
 502                         r = bind_remount_recursive(p, MS_RDONLY, MS_RDONLY, NULL);
 503                         if (r < 0)
 504                                 return log_error_errno(r, "Failed to make bind mount '%s' read-only: %m", p);
 505
 506                         break;
 507
 508                 case IMAGE_RAW:
 509                 case IMAGE_BLOCK: {
 510                         _cleanup_(dissected_image_unrefp) DissectedImage *m = NULL;
 511                         _cleanup_(loop_device_unrefp) LoopDevice *d = NULL;
 512                         _cleanup_(decrypted_image_unrefp) DecryptedImage *di = NULL;
 513                         _cleanup_(verity_settings_done) VeritySettings verity_settings = VERITY_SETTINGS_DEFAULT;
 514                         DissectImageFlags flags =
 515                                 DISSECT_IMAGE_READ_ONLY |
 516                                 DISSECT_IMAGE_GENERIC_ROOT |
 517                                 DISSECT_IMAGE_REQUIRE_ROOT |
 518                                 DISSECT_IMAGE_MOUNT_ROOT_ONLY |
 519                                 DISSECT_IMAGE_USR_NO_ROOT;
 520
 521                         r = verity_settings_load(&verity_settings, img->path, NULL, NULL);
 522                         if (r < 0)
 523                                 return log_error_errno(r, "Failed to read verity artifacts for %s: %m", img->path);
 524
 525                         if (verity_settings.data_path)
 526                                 flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
 527
 528                         r = loop_device_make_by_path(
 529                                         img->path,
 530                                         O_RDONLY,
 531                                         FLAGS_SET(flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
 532                                         &d);
 533                         if (r < 0)
 534                                 return log_error_errno(r, "Failed to set up loopback device for %s: %m", img->path);
 535
 536                         r = dissect_image_and_warn(
 537                                         d->fd,
 538                                         img->path,
 539                                         &verity_settings,
 540                                         NULL,
 541                                         d->diskseq,
 542                                         d->uevent_seqnum_not_before,
 543                                         d->timestamp_not_before,
 544                                         flags,
 545                                         &m);
 546                         if (r < 0)
 547                                 return r;
 548
 549                         r = dissected_image_load_verity_sig_partition(
 550                                         m,
 551                                         d->fd,
 552                                         &verity_settings);
 553                         if (r < 0)
 554                                 return r;
 555
 556                         r = dissected_image_decrypt_interactively(
 557                                         m, NULL,
 558                                         &verity_settings,
 559                                         flags,
 560                                         &di);
 561                         if (r < 0)
 562                                 return r;
 563
 564                         r = dissected_image_mount_and_warn(
 565                                         m,
 566                                         p,
 567                                         UID_INVALID,
 568                                         UID_INVALID,
 569                                         flags);
 570                         if (r < 0)
 571                                 return r;
 572
 573                         if (di) {
 574                                 r = decrypted_image_relinquish(di);
 575                                 if (r < 0)
 576                                         return log_error_errno(r, "Failed to relinquish DM devices: %m");
 577                         }
 578
 579                         loop_device_relinquish(d);
 580                         break;
 581                 }
 582                 default:
 583                         assert_not_reached();
 584                 }
 585
 586                 r = validate_version(
 587                                 p,
 588                                 img,
 589                                 host_os_release_id,
 590                                 host_os_release_version_id,
 591                                 host_os_release_sysext_level);
 592                 if (r < 0)
 593                         return r;
 594                 if (r == 0) {
 595                         n_ignored++;
 596                         continue;
 597                 }
 598
 599                 /* Nice! This one is an extension we want. */
 600                 r = strv_extend(&extensions, img->name);
 601                 if (r < 0)
 602                         return log_oom();
 603
 604                 n_extensions ++;
 605         }
 606
 607         /* Nothing left? Then shortcut things */
 608         if (n_extensions == 0) {
 609                 if (n_ignored > 0)
 610                         log_info("No suitable extensions found (%u ignored due to incompatible version).", n_ignored);
 611                 else
 612                         log_info("No extensions found.");
 613                 return 0;
 614         }
 615
 616         /* Order by version sort with strverscmp_improved() */
 617         typesafe_qsort(extensions, n_extensions, strverscmp_improvedp);
 618
 619         buf = strv_join(extensions, "', '");
 620         if (!buf)
 621                 return log_oom();
 622
 623         log_info("Using extensions '%s'.", buf);
 624
 625         /* Build table of extension paths (in reverse order) */
 626         paths = new0(char*, n_extensions + 1);
 627         if (!paths)
 628                 return log_oom();
 629
 630         for (size_t k = 0; k < n_extensions; k++) {
 631                 _cleanup_free_ char *p = NULL;
 632
 633                 assert_se(img = hashmap_get(images, extensions[n_extensions - 1 - k]));
 634
 635                 p = path_join(workspace, "extensions", img->name);
 636                 if (!p)
 637                         return log_oom();
 638
 639                 paths[k] = TAKE_PTR(p);
 640         }
 641
 642         /* Let's now unmerge the status quo ante, since to build the new overlayfs we need a reference to the
 643          * underlying fs. */
 644         STRV_FOREACH(h, arg_hierarchies) {
 645                 _cleanup_free_ char *resolved = NULL;
 646
 647                 r = chase_symlinks(*h, arg_root, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &resolved, NULL);
 648                 if (r < 0)
 649                         return log_error_errno(r, "Failed to resolve hierarchy '%s%s': %m", strempty(arg_root), *h);
 650
 651                 r = unmerge_hierarchy(resolved);
 652                 if (r < 0)
 653                         return r;
 654         }
 655
 656         /* Create overlayfs mounts for all hierarchies */
 657         STRV_FOREACH(h, arg_hierarchies) {
 658                 _cleanup_free_ char *meta_path = NULL, *overlay_path = NULL;
 659
 660                 meta_path = path_join(workspace, "meta", *h); /* The place where to store metadata about this instance */
 661                 if (!meta_path)
 662                         return log_oom();
 663
 664                 overlay_path = path_join(workspace, "overlay", *h); /* The resulting overlayfs instance */
 665                 if (!overlay_path)
 666                         return log_oom();
 667
 668                 r = merge_hierarchy(*h, extensions, paths, meta_path, overlay_path);
 669                 if (r < 0)
 670                         return r;
 671         }
 672
 673         /* And move them all into place. This is where things appear in the host namespace */
 674         STRV_FOREACH(h, arg_hierarchies) {
 675                 _cleanup_free_ char *p = NULL, *resolved = NULL;
 676
 677                 p = path_join(workspace, "overlay", *h);
 678                 if (!p)
 679                         return log_oom();
 680
 681                 if (laccess(p, F_OK) < 0) {
 682                         if (errno != ENOENT)
 683                                 return log_error_errno(errno, "Failed to check if '%s' exists: %m", p);
 684
 685                         /* Hierarchy apparently was empty in all extensions, and wasn't mounted, ignoring. */
 686                         continue;
 687                 }
 688
 689                 r = chase_symlinks(*h, arg_root, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &resolved, NULL);
 690                 if (r < 0)
 691                         return log_error_errno(r, "Failed to resolve hierarchy '%s%s': %m", strempty(arg_root), *h);
 692
 693                 r = mkdir_p(resolved, 0755);
 694                 if (r < 0)
 695                         return log_error_errno(r, "Failed to create hierarchy mount point '%s': %m", resolved);
 696
 697                 r = mount_nofollow_verbose(LOG_ERR, p, resolved, NULL, MS_BIND, NULL);
 698                 if (r < 0)
 699                         return r;
 700
 701                 log_info("Merged extensions into '%s'.", resolved);
 702         }
 703
 704         return 1;
 705 }
 706
 707 static int merge(Hashmap *images) {
 708         pid_t pid;
 709         int r;
 710
 711         r = safe_fork("(sd-sysext)", FORK_DEATHSIG|FORK_LOG|FORK_NEW_MOUNTNS, &pid);
 712         if (r < 0)
 713                 return log_error_errno(r, "Failed to fork off child: %m");
 714         if (r == 0) {
 715                 /* Child with its own mount namespace */
 716
 717                 r = merge_subprocess(images, "/run/systemd/sysext");
 718                 if (r < 0)
 719                         _exit(EXIT_FAILURE);
 720
 721                 /* Our namespace ceases to exist here, also implicitly detaching all temporary mounts we
 722                  * created below /run. Nice! */
 723
 724                 _exit(r > 0 ? EXIT_SUCCESS : 123); /* 123 means: didn't find any extensions */
 725         }
 726
 727         r = wait_for_terminate_and_check("(sd-sysext)", pid, WAIT_LOG_ABNORMAL);
 728         if (r < 0)
 729                 return r;
 730
 731         return r != 123; /* exit code 123 means: didn't do anything */
 732 }
 733
 734 static int image_discover_and_read_metadata(Hashmap **ret_images) {
 735         _cleanup_(hashmap_freep) Hashmap *images = NULL;
 736         Image *img;
 737         int r;
 738
 739         assert(ret_images);
 740
 741         images = hashmap_new(&image_hash_ops);
 742         if (!images)
 743                 return log_oom();
 744
 745         r = image_discover(IMAGE_EXTENSION, arg_root, images);
 746         if (r < 0)
 747                 return log_error_errno(r, "Failed to discover extension images: %m");
 748
 749         HASHMAP_FOREACH(img, images) {
 750                 r = image_read_metadata(img);
 751                 if (r < 0)
 752                         return log_error_errno(r, "Failed to read metadata for image %s: %m", img->name);
 753         }
 754
 755         *ret_images = TAKE_PTR(images);
 756
 757         return 0;
 758 }
 759
 760 static int verb_merge(int argc, char **argv, void *userdata) {
 761         _cleanup_(hashmap_freep) Hashmap *images = NULL;
 762         int r;
 763
 764         if (!have_effective_cap(CAP_SYS_ADMIN))
 765                 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Need to be privileged.");
 766
 767         r = image_discover_and_read_metadata(&images);
 768         if (r < 0)
 769                 return r;
 770
 771         /* In merge mode fail if things are already merged. (In --refresh mode below we'll unmerge if we find
 772          * things are already merged...) */
 773         STRV_FOREACH(p, arg_hierarchies) {
 774                 _cleanup_free_ char *resolved = NULL;
 775
 776                 r = chase_symlinks(*p, arg_root, CHASE_PREFIX_ROOT, &resolved, NULL);
 777                 if (r == -ENOENT) {
 778                         log_debug_errno(r, "Hierarchy '%s%s' does not exist, ignoring.", strempty(arg_root), *p);
 779                         continue;
 780                 }
 781                 if (r < 0)
 782                         return log_error_errno(r, "Failed to resolve path to hierarchy '%s%s': %m", strempty(arg_root), *p);
 783
 784                 r = is_our_mount_point(resolved);
 785                 if (r < 0)
 786                         return r;
 787                 if (r > 0)
 788                         return log_error_errno(SYNTHETIC_ERRNO(EBUSY),
 789                                                "Hierarchy '%s' is already merged.", *p);
 790         }
 791
 792         return merge(images);
 793 }
 794
 795 static int verb_refresh(int argc, char **argv, void *userdata) {
 796         _cleanup_(hashmap_freep) Hashmap *images = NULL;
 797         int r;
 798
 799         if (!have_effective_cap(CAP_SYS_ADMIN))
 800                 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Need to be privileged.");
 801
 802         r = image_discover_and_read_metadata(&images);
 803         if (r < 0)
 804                 return r;
 805
 806         r = merge(images); /* Returns > 0 if it did something, i.e. a new overlayfs is mounted now. When it
 807                             * does so it implicitly unmounts any overlayfs placed there before. Returns == 0
 808                             * if it did nothing, i.e. no extension images found. In this case the old
 809                             * overlayfs remains in place if there was one. */
 810         if (r < 0)
 811                 return r;
 812         if (r == 0) /* No images found? Then unmerge. The goal of --refresh is after all that after having
 813                      * called there's a guarantee that the merge status matches the installed extensions. */
 814                 r = unmerge();
 815
 816         /* Net result here is that:
 817          *
 818          * 1. If an overlayfs was mounted before and no extensions exist anymore, we'll have unmerged things.
 819          *
 820          * 2. If an overlayfs was mounted before, and there are still extensions installed' we'll have
 821          *    unmerged and then merged things again.
 822          *
 823          * 3. If an overlayfs so far wasn't mounted, and there are extensions installed, we'll have it
 824          *    mounted now.
 825          *
 826          * 4. If there was no overlayfs mount so far, and no extensions installed, we implement a NOP.
 827          */
 828
 829         return 0;
 830 }
 831
 832 static int verb_list(int argc, char **argv, void *userdata) {
 833         _cleanup_(hashmap_freep) Hashmap *images = NULL;
 834         _cleanup_(table_unrefp) Table *t = NULL;
 835         Image *img;
 836         int r;
 837
 838         images = hashmap_new(&image_hash_ops);
 839         if (!images)
 840                 return log_oom();
 841
 842         r = image_discover(IMAGE_EXTENSION, arg_root, images);
 843         if (r < 0)
 844                 return log_error_errno(r, "Failed to discover extension images: %m");
 845
 846         if ((arg_json_format_flags & JSON_FORMAT_OFF) && hashmap_isempty(images)) {
 847                 log_info("No OS extensions found.");
 848                 return 0;
 849         }
 850
 851         t = table_new("name", "type", "path", "time");
 852         if (!t)
 853                 return log_oom();
 854
 855         HASHMAP_FOREACH(img, images) {
 856                 r = table_add_many(
 857                                 t,
 858                                 TABLE_STRING, img->name,
 859                                 TABLE_STRING, image_type_to_string(img->type),
 860                                 TABLE_PATH, img->path,
 861                                 TABLE_TIMESTAMP, img->mtime != 0 ? img->mtime : img->crtime);
 862                 if (r < 0)
 863                         return table_log_add_error(r);
 864         }
 865
 866         (void) table_set_sort(t, (size_t) 0);
 867
 868         return table_print_with_pager(t, arg_json_format_flags, arg_pager_flags, arg_legend);
 869 }
 870
 871 static int verb_help(int argc, char **argv, void *userdata) {
 872         _cleanup_free_ char *link = NULL;
 873         int r;
 874
 875         r = terminal_urlify_man("systemd-sysext", "1", &link);
 876         if (r < 0)
 877                 return log_oom();
 878
 879         printf("%1$s [OPTIONS...] [DEVICE]\n"
 880                "\n%5$sMerge extension images into /usr/ and /opt/ hierarchies.%6$s\n"
 881                "\n%3$sCommands:%4$s\n"
 882                "  status                  Show current merge status (default)\n"
 883                "  merge                   Merge extensions into /usr/ and /opt/\n"
 884                "  unmerge                 Unmerge extensions from /usr/ and /opt/\n"
 885                "  refresh                 Unmerge/merge extensions again\n"
 886                "  list                    List installed extensions\n"
 887                "  -h --help               Show this help\n"
 888                "     --version            Show package version\n"
 889                "\n%3$sOptions:%4$s\n"
 890                "     --no-pager           Do not pipe output into a pager\n"
 891                "     --no-legend          Do not show the headers and footers\n"
 892                "     --root=PATH          Operate relative to root path\n"
 893                "     --json=pretty|short|off\n"
 894                "                          Generate JSON output\n"
 895                "     --force              Ignore version incompatibilities\n"
 896                "\nSee the %2$s for details.\n",
 897                program_invocation_short_name,
 898                link,
 899                ansi_underline(),
 900                ansi_normal(),
 901                ansi_highlight(),
 902                ansi_normal());
 903
 904         return 0;
 905 }
 906
 907 static int parse_argv(int argc, char *argv[]) {
 908
 909         enum {
 910                 ARG_VERSION = 0x100,
 911                 ARG_NO_PAGER,
 912                 ARG_NO_LEGEND,
 913                 ARG_ROOT,
 914                 ARG_JSON,
 915                 ARG_FORCE,
 916         };
 917
 918         static const struct option options[] = {
 919                 { "help",      no_argument,       NULL, 'h'           },
 920                 { "version",   no_argument,       NULL, ARG_VERSION   },
 921                 { "no-pager",  no_argument,       NULL, ARG_NO_PAGER  },
 922                 { "no-legend", no_argument,       NULL, ARG_NO_LEGEND },
 923                 { "root",      required_argument, NULL, ARG_ROOT      },
 924                 { "json",      required_argument, NULL, ARG_JSON      },
 925                 { "force",     no_argument,       NULL, ARG_FORCE     },
 926                 {}
 927         };
 928
 929         int c, r;
 930
 931         assert(argc >= 0);
 932         assert(argv);
 933
 934         while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
 935
 936                 switch (c) {
 937
 938                 case 'h':
 939                         return verb_help(argc, argv, NULL);
 940
 941                 case ARG_VERSION:
 942                         return version();
 943
 944                 case ARG_NO_PAGER:
 945                         arg_pager_flags |= PAGER_DISABLE;
 946                         break;
 947
 948                 case ARG_NO_LEGEND:
 949                         arg_legend = false;
 950                         break;
 951
 952                 case ARG_ROOT:
 953                         r = parse_path_argument(optarg, false, &arg_root);
 954                         if (r < 0)
 955                                 return r;
 956                         break;
 957
 958                 case ARG_JSON:
 959                         r = parse_json_argument(optarg, &arg_json_format_flags);
 960                         if (r <= 0)
 961                                 return r;
 962
 963                         break;
 964
 965                 case ARG_FORCE:
 966                         arg_force = true;
 967                         break;
 968
 969                 case '?':
 970                         return -EINVAL;
 971
 972                 default:
 973                         assert_not_reached();
 974                 }
 975
 976         return 1;
 977 }
 978
 979 static int sysext_main(int argc, char *argv[]) {
 980
 981         static const Verb verbs[] = {
 982                 { "status",   VERB_ANY, 1, VERB_DEFAULT, verb_status  },
 983                 { "merge",    VERB_ANY, 1, 0,            verb_merge   },
 984                 { "unmerge",  VERB_ANY, 1, 0,            verb_unmerge },
 985                 { "refresh",  VERB_ANY, 1, 0,            verb_refresh },
 986                 { "list",     VERB_ANY, 1, 0,            verb_list    },
 987                 { "help",     VERB_ANY, 1, 0,            verb_help    },
 988                 {}
 989         };
 990
 991         return dispatch_verb(argc, argv, verbs, NULL);
 992 }
 993
 994 static int run(int argc, char *argv[]) {
 995         int r;
 996
 997         log_setup();
 998
 999         r = parse_argv(argc, argv);
1000         if (r <= 0)
1001                 return r;
1002
1003         /* For debugging purposes it might make sense to do this for other hierarchies than /usr/ and
1004          * /opt/, but let's make that a hacker/debugging feature, i.e. env var instead of cmdline
1005          * switch. */
1006         r = parse_env_extension_hierarchies(&arg_hierarchies);
1007         if (r < 0)
1008                 return log_error_errno(r, "Failed to parse $SYSTEMD_SYSEXT_HIERARCHIES environment variable: %m");
1009
1010         return sysext_main(argc, argv);
1011 }
1012
1013 DEFINE_MAIN_FUNCTION(run);