static size_t arg_n_credentials = 0;
static char **arg_bind_user = NULL;
static bool arg_suppress_sync = false;
+static char *arg_settings_filename = NULL;
STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
+STATIC_DESTRUCTOR_REGISTER(arg_settings_filename, freep);
static int handle_arg_console(const char *arg) {
if (streq(arg, "help")) {
" --keep-unit Do not register a scope for the machine, reuse\n"
" the service unit nspawn is running in\n\n"
"%3$sUser Namespacing:%4$s\n"
- " -U --private-users=pick Run within user namespace, autoselect UID/GID range\n"
- " --private-users[=UIDBASE[:NUIDS]]\n"
+ " --private-users=no Run without user namespacing\n"
+ " --private-users=yes|pick|identity\n"
+ " Run within user namespace, autoselect UID/GID range\n"
+ " --private-users=UIDBASE[:NUIDS]\n"
" Similar, but with user configured UID/GID range\n"
" --private-users-ownership=MODE\n"
" Adjust ('chown') or map ('map') OS tree ownership\n"
- " to private UID/GID range\n\n"
+ " to private UID/GID range\n"
+ " -U Equivalent to --private-users=pick and\n"
+ " --private-users-ownership=auto\n\n"
"%3$sNetworking:%4$s\n"
" --private-network Disable network in container\n"
" --network-interface=INTERFACE\n"
};
static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
- struct ExposeArgs *args = userdata;
+ struct ExposeArgs *args = ASSERT_PTR(userdata);
assert(rtnl);
assert(m);
- assert(args);
(void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
(void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
} else if (access(p, F_OK) < 0)
return 0;
- if (dir_is_empty(q) == 0)
+ if (dir_is_empty(q, /* ignore_hidden_or_backup= */ false) == 0)
log_warning("%s is not empty, proceeding anyway.", q);
r = userns_mkdir(directory, p, 0755, 0, 0);
if (!hostname_is_valid(arg_machine, 0))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
+ /* Copy the machine name before the random suffix is added below, otherwise we won't be able
+ * to match fixed config file names. */
+ arg_settings_filename = strjoin(arg_machine, ".nspawn");
+ if (!arg_settings_filename)
+ return log_oom();
+
/* Add a random suffix when this is an ephemeral machine, so that we can run many
* instances at once without manually having to specify -M each time. */
if (arg_ephemeral)
if (strextendf(&arg_machine, "-%016" PRIx64, random_u64()) < 0)
return log_oom();
+ } else {
+ arg_settings_filename = strjoin(arg_machine, ".nspawn");
+ if (!arg_settings_filename)
+ return log_oom();
}
return 0;
NULL, /* LISTEN_PID */
NULL, /* NOTIFY_SOCKET */
NULL, /* CREDENTIALS_DIRECTORY */
+ NULL, /* LANG */
NULL
};
const char *exec_target;
n_env++;
}
+ if (arg_start_mode != START_BOOT) {
+ envp[n_env] = strdup("LANG=" SYSTEMD_NSPAWN_LOCALE);
+ if (!envp[n_env])
+ return log_oom();
+ n_env++;
+ }
+
env_use = strv_env_merge(envp, os_release_pairs, arg_setenv);
if (!env_use)
return log_oom();
IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
arg_uid_shift != 0) {
- r = remount_idmap(directory, arg_uid_shift, arg_uid_range, REMOUNT_IDMAP_HOST_ROOT);
+ r = remount_idmap(directory, arg_uid_shift, arg_uid_range, UID_INVALID, REMOUNT_IDMAPPING_HOST_ROOT);
if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) {
/* This might fail because the kernel or file system doesn't support idmapping. We
* can't really distinguish this nicely, nor do we have any guarantees about the
* quadruplet, consisting of host and container UID + GID. */
for (size_t i = 0; i < n_bind_user_uid; i++) {
- uid_t payload_uid = bind_user_uid[i*2+offset],
- host_uid = bind_user_uid[i*2+offset+1];
+ uid_t payload_uid = bind_user_uid[i*4+offset],
+ host_uid = bind_user_uid[i*4+offset+1];
assert(previous_uid <= payload_uid);
assert(payload_uid < arg_uid_range);
_cleanup_(settings_freep) Settings *settings = NULL;
_cleanup_fclose_ FILE *f = NULL;
_cleanup_free_ char *p = NULL;
- const char *fn;
int r;
if (arg_oci_bundle)
if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
return 0;
- fn = strjoina(arg_machine, ".nspawn");
-
/* We first look in the admin's directories in /etc and /run */
FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
_cleanup_free_ char *j = NULL;
- j = path_join(i, fn);
+ j = path_join(i, arg_settings_filename);
if (!j)
return log_oom();
* actual image we shall boot. */
if (arg_image) {
- p = file_in_same_dir(arg_image, fn);
+ p = file_in_same_dir(arg_image, arg_settings_filename);
if (!p)
return log_oom();
} else if (arg_directory && !path_equal(arg_directory, "/")) {
- p = file_in_same_dir(arg_directory, fn);
+ p = file_in_same_dir(arg_directory, arg_settings_filename);
if (!p)
return log_oom();
}
if (l < 0)
return log_error_errno(errno, "Failed to read cgroup mode: %m");
if (l != sizeof(arg_unified_cgroup_hierarchy))
- return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zu bytes).%s",
+ return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
l, l == 0 ? " The child is most likely dead." : "");
}
}
static int cant_be_in_netns(void) {
- union sockaddr_union sa = {
- .un = {
- .sun_family = AF_UNIX,
- .sun_path = "/run/udev/control",
- },
- };
char udev_path[STRLEN("/proc//ns/net") + DECIMAL_STR_MAX(pid_t)];
_cleanup_free_ char *udev_ns = NULL, *our_ns = NULL;
_cleanup_close_ int fd = -1;
if (fd < 0)
return log_error_errno(errno, "Failed to allocate udev control socket: %m");
- if (connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un)) < 0) {
-
- if (errno == ENOENT || ERRNO_IS_DISCONNECT(errno))
+ r = connect_unix_path(fd, AT_FDCWD, "/run/udev/control");
+ if (r < 0) {
+ if (r == -ENOENT || ERRNO_IS_DISCONNECT(r))
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
- return log_error_errno(errno, "Failed to connect socket to udev control socket: %m");
+ return log_error_errno(r, "Failed to connect socket to udev control socket: %m");
}
r = getpeercred(fd, &ucred);
arg_image,
arg_read_only ? O_RDONLY : O_RDWR,
FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
+ LOCK_SH,
&loop);
if (r < 0) {
log_error_errno(r, "Failed to set up loopback block device: %m");
goto finish;
}
- r = dissect_image_and_warn(
- loop->fd,
- arg_image,
+ r = dissect_loop_device_and_warn(
+ loop,
&arg_verity_settings,
NULL,
- loop->diskseq,
- loop->uevent_seqnum_not_before,
- loop->timestamp_not_before,
dissect_image_flags,
&dissected_image);
if (r == -ENOPKG) {
projects / thirdparty / systemd.git / blobdiff