]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #25602 from fbuihuu/fix-TEST-73-LOCALE
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
88213476 2
349cc4a5 3#if HAVE_BLKID
8fe0087e 4#endif
88213476 5#include <errno.h>
88213476 6#include <getopt.h>
503f480f 7#include <linux/fs.h>
1b9e5b12 8#include <linux/loop.h>
349cc4a5 9#if HAVE_SELINUX
8fe0087e 10#include <selinux/selinux.h>
1b9e5b12 11#endif
8fe0087e 12#include <stdlib.h>
8fe0087e 13#include <sys/file.h>
335d2ead 14#include <sys/ioctl.h>
8fe0087e
LP		 15#include <sys/personality.h>
16#include <sys/prctl.h>
17#include <sys/types.h>
6916b164 18#include <sys/wait.h>
335d2ead 19#include <termios.h>
8fe0087e 20#include <unistd.h>
1b9e5b12 21
b053cd5f 22#include "sd-bus.h"
1f0cd86b 23#include "sd-daemon.h"
1f0cd86b 24#include "sd-id128.h"
8fe0087e 25
b5efdb8a 26#include "alloc-util.h"
8fe0087e
LP		 27#include "barrier.h"
28#include "base-filesystem.h"
29#include "blkid-util.h"
30#include "btrfs-util.h"
d6b4d1c7 31#include "build.h"
b8ea7a6e 32#include "bus-error.h"
b053cd5f 33#include "bus-util.h"
8fe0087e 34#include "cap-list.h"
430f0182 35#include "capability-util.h"
04d391da 36#include "cgroup-util.h"
f4351959 37#include "chase-symlinks.h"
8fe0087e 38#include "copy.h"
d107bb7d 39#include "cpu-set-util.h"
786d19fd 40#include "creds-util.h"
4fc9982c 41#include "dev-setup.h"
57f1b61b 42#include "discover-image.h"
2d845785 43#include "dissect-image.h"
8fe0087e 44#include "env-util.h"
3652872a 45#include "escape.h"
3ffd4af2 46#include "fd-util.h"
842f3b0f 47#include "fdset.h"
a5c32cff 48#include "fileio.h"
f97b34a6 49#include "format-util.h"
f4f15635 50#include "fs-util.h"
1b9e5b12 51#include "gpt.h"
4623e8e6 52#include "hexdecoct.h"
e2054217 53#include "hostname-setup.h"
8fe0087e 54#include "hostname-util.h"
910fd145 55#include "id128-util.h"
3652872a 56#include "io-util.h"
8fe0087e 57#include "log.h"
2d845785 58#include "loop-util.h"
8fe0087e 59#include "loopback-setup.h"
8fe0087e 60#include "macro.h"
44dbef90 61#include "main-func.h"
f5947a5e 62#include "missing_sched.h"
8fe0087e 63#include "mkdir.h"
4349cd7c 64#include "mount-util.h"
049af8ad 65#include "mountpoint-util.h"
0cb8e3d1 66#include "namespace-util.h"
8fe0087e 67#include "netlink-util.h"
2f893044 68#include "nspawn-bind-user.h"
07630cea 69#include "nspawn-cgroup.h"
3652872a 70#include "nspawn-creds.h"
3603efde 71#include "nspawn-def.h"
07630cea
LP		 72#include "nspawn-expose-ports.h"
73#include "nspawn-mount.h"
74#include "nspawn-network.h"
de40a303 75#include "nspawn-oci.h"
7336138e 76#include "nspawn-patch-uid.h"
07630cea 77#include "nspawn-register.h"
910fd145 78#include "nspawn-seccomp.h"
07630cea
LP		 79#include "nspawn-settings.h"
80#include "nspawn-setuid.h"
7732f92b 81#include "nspawn-stub-pid1.h"
c9394f4f 82#include "nspawn-util.h"
91181e07 83#include "nspawn.h"
d8b4d14d 84#include "nulstr-util.h"
d58ad743 85#include "os-util.h"
50ebcf6c 86#include "pager.h"
614b022c 87#include "parse-argument.h"
6bedfcbb 88#include "parse-util.h"
294bf0c3 89#include "pretty-print.h"
0b452006 90#include "process-util.h"
8fe0087e
LP		 91#include "ptyfwd.h"
92#include "random-util.h"
8869a0b4 93#include "raw-clone.h"
86775e35 94#include "resolve-util.h"
bf428efb 95#include "rlimit-util.h"
8fe0087e 96#include "rm-rf.h"
de40a303
LP		 97#if HAVE_SECCOMP
98#include "seccomp-util.h"
99#endif
68b02049 100#include "selinux-util.h"
8fe0087e 101#include "signal-util.h"
2583fbea 102#include "socket-util.h"
8fcde012 103#include "stat-util.h"
15a5e950 104#include "stdio-util.h"
5c828e66 105#include "string-table.h"
07630cea 106#include "string-util.h"
8fe0087e 107#include "strv.h"
de40a303 108#include "sysctl-util.h"
8fe0087e 109#include "terminal-util.h"
e4de7287 110#include "tmpfile-util.h"
affb60b1 111#include "umask-util.h"
43c3fb46 112#include "unit-name.h"
b1d4f8e1 113#include "user-util.h"
e9642be2 114
e96ceaba
LP		 115/* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
116#define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
e79581dd 117#define NSPAWN_MOUNT_TUNNEL "/run/host/incoming"
0e7ac751 118
2a49b612
ZJS		 119#define EXIT_FORCE_RESTART 133
120
113cea80
DH		 121typedef enum ContainerStatus {
122 CONTAINER_TERMINATED,
6145bb4f 123 CONTAINER_REBOOTED,
113cea80
DH		 124} ContainerStatus;
125
88213476 126static char *arg_directory = NULL;
ec16945e 127static char *arg_template = NULL;
5f932eb9 128static char *arg_chdir = NULL;
b53ede69
PW		 129static char *arg_pivot_root_new = NULL;
130static char *arg_pivot_root_old = NULL;
687d0825 131static char *arg_user = NULL;
de40a303
LP		 132static uid_t arg_uid = UID_INVALID;
133static gid_t arg_gid = GID_INVALID;
134static gid_t* arg_supplementary_gids = NULL;
135static size_t arg_n_supplementary_gids = 0;
9444b1f2 136static sd_id128_t arg_uuid = {};
3a9530e5
LP		 137static char *arg_machine = NULL; /* The name used by the host to refer to this */
138static char *arg_hostname = NULL; /* The name the payload sees by default */
c74e630d
LP		 139static const char *arg_selinux_context = NULL;
140static const char *arg_selinux_apifs_context = NULL;
de40a303 141static char *arg_slice = NULL;
ff01d048 142static bool arg_private_network = false;
bc2f673e 143static bool arg_read_only = false;
7732f92b 144static StartMode arg_start_mode = START_PID1;
ec16945e 145static bool arg_ephemeral = false;
57fb9fb5 146static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 147static bool arg_link_journal_try = false;
520e0d54 148static uint64_t arg_caps_retain =
50b52222
LP		 149 (1ULL << CAP_AUDIT_CONTROL) |
150 (1ULL << CAP_AUDIT_WRITE) |
5076f0cc
LP		 151 (1ULL << CAP_CHOWN) |
152 (1ULL << CAP_DAC_OVERRIDE) |
153 (1ULL << CAP_DAC_READ_SEARCH) |
154 (1ULL << CAP_FOWNER) |
155 (1ULL << CAP_FSETID) |
156 (1ULL << CAP_IPC_OWNER) |
157 (1ULL << CAP_KILL) |
158 (1ULL << CAP_LEASE) |
159 (1ULL << CAP_LINUX_IMMUTABLE) |
50b52222 160 (1ULL << CAP_MKNOD) |
5076f0cc
LP		 161 (1ULL << CAP_NET_BIND_SERVICE) |
162 (1ULL << CAP_NET_BROADCAST) |
163 (1ULL << CAP_NET_RAW) |
5076f0cc 164 (1ULL << CAP_SETFCAP) |
50b52222 165 (1ULL << CAP_SETGID) |
5076f0cc
LP		 166 (1ULL << CAP_SETPCAP) |
167 (1ULL << CAP_SETUID) |
168 (1ULL << CAP_SYS_ADMIN) |
50b52222 169 (1ULL << CAP_SYS_BOOT) |
5076f0cc
LP		 170 (1ULL << CAP_SYS_CHROOT) |
171 (1ULL << CAP_SYS_NICE) |
172 (1ULL << CAP_SYS_PTRACE) |
d87be9b0 173 (1ULL << CAP_SYS_RESOURCE) |
50b52222 174 (1ULL << CAP_SYS_TTY_CONFIG);
88fc9c9b 175static uint64_t arg_caps_ambient = 0;
de40a303 176static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
5a8af538 177static CustomMount *arg_custom_mounts = NULL;
88614c8a 178static size_t arg_n_custom_mounts = 0;
f4889f65 179static char **arg_setenv = NULL;
284c0b91 180static bool arg_quiet = false;
eb91eb18 181static bool arg_register = true;
89f7c846 182static bool arg_keep_unit = false;
aa28aefe 183static char **arg_network_interfaces = NULL;
c74e630d 184static char **arg_network_macvlan = NULL;
4bbfe7ad 185static char **arg_network_ipvlan = NULL;
69c79d3c 186static bool arg_network_veth = false;
f6d6bad1 187static char **arg_network_veth_extra = NULL;
f757855e 188static char *arg_network_bridge = NULL;
22b28dfd 189static char *arg_network_zone = NULL;
d7bea6b6 190static char *arg_network_namespace_path = NULL;
bb068de0 191static PagerFlags arg_pager_flags = 0;
050f7277 192static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 193static char *arg_image = NULL;
de40a303 194static char *arg_oci_bundle = NULL;
f757855e 195static VolatileMode arg_volatile_mode = VOLATILE_NO;
6d0b55c2 196static ExposePort *arg_expose_ports = NULL;
f36933fe 197static char **arg_property = NULL;
de40a303 198static sd_bus_message *arg_property_message = NULL;
0de7acce 199static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
6dac160c 200static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
6c045a99 201static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
c6c8f6e2 202static int arg_kill_signal = 0;
5da38d07 203static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
f757855e
LP		 204static SettingsMask arg_settings_mask = 0;
205static int arg_settings_trusted = -1;
206static char **arg_parameters = NULL;
6aadfa4c 207static const char *arg_container_service_name = "systemd-nspawn";
9c1e04d0 208static bool arg_notify_ready = false;
5a8ff0e6 209static bool arg_use_cgns = true;
0c582db0 210static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
1099ceeb 211static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
aee36b4e 212static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
6b000af4
LP		 213static char **arg_syscall_allow_list = NULL;
214static char **arg_syscall_deny_list = NULL;
de40a303
LP		 215#if HAVE_SECCOMP
216static scmp_filter_ctx arg_seccomp = NULL;
217#endif
bf428efb 218static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
66edd963 219static bool arg_no_new_privileges = false;
81f345df
LP		 220static int arg_oom_score_adjust = 0;
221static bool arg_oom_score_adjust_set = false;
0985c7c4 222static CPUSet arg_cpu_set = {};
09d423e9 223static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
1688841f 224static TimezoneMode arg_timezone = TIMEZONE_AUTO;
f5fbe71d 225static unsigned arg_console_width = UINT_MAX, arg_console_height = UINT_MAX;
de40a303
LP		 226static DeviceNode* arg_extra_nodes = NULL;
227static size_t arg_n_extra_nodes = 0;
228static char **arg_sysctl = NULL;
229static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
3652872a
LP		 230static Credential *arg_credentials = NULL;
231static size_t arg_n_credentials = 0;
2f893044 232static char **arg_bind_user = NULL;
4a4654e0 233static bool arg_suppress_sync = false;
3603f151 234static char *arg_settings_filename = NULL;
88213476 235
6145bb4f
LP		 236STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
237STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
238STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
239STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
240STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
241STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
242STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
243STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
244STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
245STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
246STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
247STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
248STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
249STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
250STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
251STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
252STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
253STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
254STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
255STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
256STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
257STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
258STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
89e62e0b 259STATIC_DESTRUCTOR_REGISTER(arg_verity_settings, verity_settings_done);
6b000af4
LP		 260STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
261STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
6145bb4f
LP		 262#if HAVE_SECCOMP
263STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
264#endif
0985c7c4 265STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
6145bb4f 266STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
2f893044 267STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
3603f151 268STATIC_DESTRUCTOR_REGISTER(arg_settings_filename, freep);
6145bb4f 269
dce66ffe
ZJS		 270static int handle_arg_console(const char *arg) {
271 if (streq(arg, "help")) {
10e8a60b
LP		 272 puts("autopipe\n"
273 "interactive\n"
dce66ffe 274 "passive\n"
10e8a60b
LP		 275 "pipe\n"
276 "read-only");
dce66ffe
ZJS		 277 return 0;
278 }
279
280 if (streq(arg, "interactive"))
281 arg_console_mode = CONSOLE_INTERACTIVE;
282 else if (streq(arg, "read-only"))
283 arg_console_mode = CONSOLE_READ_ONLY;
284 else if (streq(arg, "passive"))
285 arg_console_mode = CONSOLE_PASSIVE;
554c4beb
LP		 286 else if (streq(arg, "pipe")) {
287 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
288 log_full(arg_quiet ? LOG_DEBUG : LOG_NOTICE,
289 "Console mode 'pipe' selected, but standard input/output are connected to an interactive TTY. "
290 "Most likely you want to use 'interactive' console mode for proper interactivity and shell job control. "
291 "Proceeding anyway.");
292
dce66ffe 293 arg_console_mode = CONSOLE_PIPE;
10e8a60b
LP		 294 } else if (streq(arg, "autopipe")) {
295 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
296 arg_console_mode = CONSOLE_INTERACTIVE;
297 else
298 arg_console_mode = CONSOLE_PIPE;
554c4beb 299 } else
dce66ffe
ZJS		 300 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
301
302 arg_settings_mask |= SETTING_CONSOLE_MODE;
303 return 1;
304}
305
37ec0fdd
LP		 306static int help(void) {
307 _cleanup_free_ char *link = NULL;
308 int r;
309
384c2c32 310 pager_open(arg_pager_flags);
50ebcf6c 311
37ec0fdd
LP		 312 r = terminal_urlify_man("systemd-nspawn", "1", &link);
313 if (r < 0)
314 return log_oom();
315
25148653 316 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
37a92352 317 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
a8828ed9
DW		 318 " -h --help Show this help\n"
319 " --version Print version string\n"
69c79d3c 320 " -q --quiet Do not show status information\n"
bb068de0 321 " --no-pager Do not pipe output into a pager\n"
25148653
LP		 322 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
323 "%3$sImage:%4$s\n"
1b9e5b12 324 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 325 " --template=PATH Initialize root directory from template directory,\n"
326 " if missing\n"
327 " -x --ephemeral Run container with snapshot of root directory, and\n"
328 " remove it after exit\n"
25e68fd3
LP		 329 " -i --image=PATH Root file system disk image (or device node) for\n"
330 " the container\n"
de40a303 331 " --oci-bundle=PATH OCI bundle directory\n"
25148653
LP		 332 " --read-only Mount the root directory read-only\n"
333 " --volatile[=MODE] Run the system in volatile mode\n"
25e68fd3 334 " --root-hash=HASH Specify verity root hash for root disk image\n"
c2923fdc
LB		 335 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
336 " as a DER encoded PKCS7, either as a path to a file\n"
337 " or as an ASCII base64 encoded string prefixed by\n"
338 " 'base64:'\n"
e7cbe5cb 339 " --verity-data=PATH Specify hash device for verity\n"
25148653
LP		 340 " --pivot-root=PATH[:PATH]\n"
341 " Pivot root to given directory in the container\n\n"
342 "%3$sExecution:%4$s\n"
7732f92b 343 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
a8828ed9 344 " -b --boot Boot up full system (i.e. invoke init)\n"
5f932eb9 345 " --chdir=PATH Set working directory in the container\n"
0d2a0179 346 " -E --setenv=NAME[=VALUE] Pass an environment variable to PID 1\n"
25148653
LP		 347 " -u --user=USER Run the command under specified user or UID\n"
348 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
4a4654e0
LP		 349 " --notify-ready=BOOLEAN Receive notifications from the child init process\n"
350 " --suppress-sync=BOOLEAN\n"
351 " Suppress any form of disk data synchronization\n\n"
25148653 352 "%3$sSystem Identity:%4$s\n"
a8828ed9 353 " -M --machine=NAME Set the machine name for the container\n"
3a9530e5 354 " --hostname=NAME Override the hostname for the container\n"
25148653
LP		 355 " --uuid=UUID Set a specific machine UUID for the container\n\n"
356 "%3$sProperties:%4$s\n"
a8828ed9 357 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 358 " --property=NAME=VALUE Set scope unit property\n"
25148653
LP		 359 " --register=BOOLEAN Register container as machine\n"
360 " --keep-unit Do not register a scope for the machine, reuse\n"
361 " the service unit nspawn is running in\n\n"
362 "%3$sUser Namespacing:%4$s\n"
b917743d
YW		 363 " --private-users=no Run without user namespacing\n"
364 " --private-users=yes|pick|identity\n"
365 " Run within user namespace, autoselect UID/GID range\n"
366 " --private-users=UIDBASE[:NUIDS]\n"
90b4a64d 367 " Similar, but with user configured UID/GID range\n"
6c045a99
LP		 368 " --private-users-ownership=MODE\n"
369 " Adjust ('chown') or map ('map') OS tree ownership\n"
b917743d
YW		 370 " to private UID/GID range\n"
371 " -U Equivalent to --private-users=pick and\n"
372 " --private-users-ownership=auto\n\n"
25148653 373 "%3$sNetworking:%4$s\n"
69c79d3c
LP		 374 " --private-network Disable network in container\n"
375 " --network-interface=INTERFACE\n"
376 " Assign an existing network interface to the\n"
377 " container\n"
c74e630d
LP		 378 " --network-macvlan=INTERFACE\n"
379 " Create a macvlan network interface based on an\n"
380 " existing network interface to the container\n"
4bbfe7ad 381 " --network-ipvlan=INTERFACE\n"
387f6955 382 " Create an ipvlan network interface based on an\n"
4bbfe7ad 383 " existing network interface to the container\n"
a8eaaee7 384 " -n --network-veth Add a virtual Ethernet connection between host\n"
69c79d3c 385 " and container\n"
f6d6bad1
LP		 386 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
387 " Add an additional virtual Ethernet link between\n"
388 " host and container\n"
ab046dde 389 " --network-bridge=INTERFACE\n"
90b4a64d
ZJS		 390 " Add a virtual Ethernet connection to the container\n"
391 " and attach it to an existing bridge on the host\n"
392 " --network-zone=NAME Similar, but attach the new interface to an\n"
393 " an automatically managed bridge interface\n"
d7bea6b6
DP		 394 " --network-namespace-path=PATH\n"
395 " Set network namespace to the one represented by\n"
396 " the specified kernel namespace file node\n"
6d0b55c2 397 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
25148653
LP		 398 " Expose a container IP port on the host\n\n"
399 "%3$sSecurity:%4$s\n"
a8828ed9
DW		 400 " --capability=CAP In addition to the default, retain specified\n"
401 " capability\n"
402 " --drop-capability=CAP Drop the specified capability from the default set\n"
88fc9c9b
TH		 403 " --ambient-capability=CAP\n"
404 " Sets the specified capability for the started\n"
405 " process. Not useful if booting a machine.\n"
f4e803c8 406 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
960e4569
LP		 407 " --system-call-filter=LIST|~LIST\n"
408 " Permit/prohibit specific system calls\n"
25148653
LP		 409 " -Z --selinux-context=SECLABEL\n"
410 " Set the SELinux security context to be used by\n"
411 " processes in the container\n"
412 " -L --selinux-apifs-context=SECLABEL\n"
413 " Set the SELinux security context to be used by\n"
414 " API/tmpfs file systems in the container\n\n"
415 "%3$sResources:%4$s\n"
bf428efb 416 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
81f345df
LP		 417 " --oom-score-adjust=VALUE\n"
418 " Adjust the OOM score value for the payload\n"
f4e803c8
LP		 419 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
420 " --personality=ARCH Pick personality for this container\n\n"
25148653 421 "%3$sIntegration:%4$s\n"
09d423e9 422 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
1688841f 423 " --timezone=MODE Select mode of /etc/localtime initialization\n"
25148653
LP		 424 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
425 " host, try-guest, try-host\n"
426 " -j Equivalent to --link-journal=try-guest\n\n"
427 "%3$sMounts:%4$s\n"
5e5bfa6e
EY		 428 " --bind=PATH[:PATH[:OPTIONS]]\n"
429 " Bind mount a file or directory from the host into\n"
a8828ed9 430 " the container\n"
5e5bfa6e
EY		 431 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
432 " Similar, but creates a read-only bind mount\n"
de40a303
LP		 433 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
434 " it\n"
06c17c39 435 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 436 " --overlay=PATH[:PATH...]:PATH\n"
437 " Create an overlay mount from the host to \n"
438 " the container\n"
439 " --overlay-ro=PATH[:PATH...]:PATH\n"
2f893044
LP		 440 " Similar, but creates a read-only overlay mount\n"
441 " --bind-user=NAME Bind user from host to container\n\n"
25148653 442 "%3$sInput/Output:%4$s\n"
de40a303
LP		 443 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
444 " set up for the container.\n"
3652872a
LP		 445 " -P --pipe Equivalent to --console=pipe\n\n"
446 "%3$sCredentials:%4$s\n"
447 " --set-credential=ID:VALUE\n"
448 " Pass a credential with literal value to container.\n"
449 " --load-credential=ID:PATH\n"
450 " Load credential to pass to container from file or\n"
451 " AF_UNIX stream socket.\n"
bc556335
DDM		 452 "\nSee the %2$s for details.\n",
453 program_invocation_short_name,
454 link,
455 ansi_underline(),
456 ansi_normal(),
457 ansi_highlight(),
458 ansi_normal());
37ec0fdd
LP		 459
460 return 0;
88213476
LP		 461}
462
86c0dd4a 463static int custom_mount_check_all(void) {
88614c8a 464 size_t i;
5a8af538 465
5a8af538
LP		 466 for (i = 0; i < arg_n_custom_mounts; i++) {
467 CustomMount *m = &arg_custom_mounts[i];
468
0de7acce 469 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
6c045a99 470 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_OFF)
baaa35ad 471 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
c920b863 472 "--private-users-ownership=own may not be combined with custom root mounts.");
6c045a99 473 if (arg_uid_shift == UID_INVALID)
baaa35ad
ZJS		 474 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
475 "--private-users with automatic UID shift may not be combined with custom root mounts.");
825d5287 476 }
5a8af538
LP		 477 }
478
479 return 0;
480}
481
8199d554 482static int detect_unified_cgroup_hierarchy_from_environment(void) {
c78c095b 483 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
415fc41c 484 int r;
5da38d07 485
efdb0237 486 /* Allow the user to control whether the unified hierarchy is used */
c78c095b
ZJS		 487
488 e = getenv(var);
489 if (!e) {
d5fc5b2f 490 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
c78c095b
ZJS		 491 var = "UNIFIED_CGROUP_HIERARCHY";
492 e = getenv(var);
c78c095b
ZJS		 493 }
494
495 if (!isempty(e)) {
efdb0237
LP		 496 r = parse_boolean(e);
497 if (r < 0)
c78c095b 498 return log_error_errno(r, "Failed to parse $%s: %m", var);
5da38d07
TH		 499 if (r > 0)
500 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
501 else
502 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237
LP		 503 }
504
8199d554
LP		 505 return 0;
506}
507
508static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
509 int r;
510
75b0d8b8
ZJS		 511 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
512 * in the image actually supports. */
b4cccbc1
LP		 513 r = cg_all_unified();
514 if (r < 0)
515 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
516 if (r > 0) {
a8725a06
ZJS		 517 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
518 * routine only detects 231, so we'll have a false negative here for 230. */
7e6821ed 519 r = systemd_installation_has_version(directory, "230");
a8725a06
ZJS		 520 if (r < 0)
521 return log_error_errno(r, "Failed to determine systemd version in container: %m");
522 if (r > 0)
523 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
524 else
525 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
c22800e4 526 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2977724b 527 /* Mixed cgroup hierarchy support was added in 233 */
7e6821ed 528 r = systemd_installation_has_version(directory, "233");
0fd9563f
ZJS		 529 if (r < 0)
530 return log_error_errno(r, "Failed to determine systemd version in container: %m");
531 if (r > 0)
532 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
533 else
534 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
535 } else
5da38d07 536 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 537
8199d554
LP		 538 log_debug("Using %s hierarchy for container.",
539 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
540 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
541
efdb0237
LP		 542 return 0;
543}
544
8a99bd0c
ZJS		 545static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
546 uint64_t mask = 0;
547 int r;
548
549 for (;;) {
550 _cleanup_free_ char *t = NULL;
551
552 r = extract_first_word(&spec, &t, ",", 0);
553 if (r < 0)
554 return log_error_errno(r, "Failed to parse capability %s.", t);
555 if (r == 0)
556 break;
557
558 if (streq(t, "help")) {
559 for (int i = 0; i < capability_list_length(); i++) {
560 const char *name;
561
562 name = capability_to_name(i);
563 if (name)
564 puts(name);
565 }
566
567 return 0; /* quit */
568 }
569
570 if (streq(t, "all"))
f5fbe71d 571 mask = UINT64_MAX;
8a99bd0c
ZJS		 572 else {
573 r = capability_from_name(t);
574 if (r < 0)
575 return log_error_errno(r, "Failed to parse capability %s.", t);
576
577 mask |= 1ULL << r;
578 }
579 }
580
581 *ret_mask = mask;
582 return 1; /* continue */
583}
584
49048684 585static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
0c582db0
LB		 586 int r;
587
588 r = getenv_bool(name);
589 if (r == -ENXIO)
49048684 590 return 0;
0c582db0 591 if (r < 0)
49048684 592 return log_error_errno(r, "Failed to parse $%s: %m", name);
de40a303 593
0c582db0 594 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
de40a303 595 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
49048684 596 return 0;
0c582db0
LB		 597}
598
49048684 599static int parse_mount_settings_env(void) {
4f086aab 600 const char *e;
1099ceeb
LP		 601 int r;
602
603 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
49048684
ZJS		 604 if (r < 0 && r != -ENXIO)
605 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
1099ceeb
LP		 606 if (r >= 0)
607 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
4f086aab
SU		 608
609 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
49048684 610 if (streq_ptr(e, "network"))
4f086aab 611 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
4f086aab 612
49048684
ZJS		 613 else if (e) {
614 r = parse_boolean(e);
615 if (r < 0)
616 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
617
618 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
619 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
ab8ee0f2 620 }
4f086aab 621
49048684 622 return 0;
4f086aab
SU		 623}
624
49048684 625static int parse_environment(void) {
d5455d2f
LP		 626 const char *e;
627 int r;
628
49048684
ZJS		 629 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
630 if (r < 0)
631 return r;
632 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
633 if (r < 0)
634 return r;
635 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
636 if (r < 0)
637 return r;
638 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
639 if (r < 0)
640 return r;
d5455d2f 641
49048684
ZJS		 642 r = parse_mount_settings_env();
643 if (r < 0)
644 return r;
d5455d2f 645
489fae52
ZJS		 646 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
647 * even if it is supported. If not supported, it has no effect. */
de40a303 648 if (!cg_ns_supported())
489fae52 649 arg_use_cgns = false;
de40a303
LP		 650 else {
651 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
652 if (r < 0) {
653 if (r != -ENXIO)
49048684 654 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
de40a303
LP		 655
656 arg_use_cgns = true;
657 } else {
658 arg_use_cgns = r > 0;
659 arg_settings_mask |= SETTING_USE_CGNS;
660 }
661 }
d5455d2f
LP		 662
663 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
664 if (e)
665 arg_container_service_name = e;
666
4a4654e0
LP		 667 r = getenv_bool("SYSTEMD_SUPPRESS_SYNC");
668 if (r >= 0)
669 arg_suppress_sync = r;
670 else if (r != -ENXIO)
671 log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
672
49048684 673 return detect_unified_cgroup_hierarchy_from_environment();
d5455d2f
LP		 674}
675
88213476 676static int parse_argv(int argc, char *argv[]) {
a41fe3a2 677 enum {
acbeb427
ZJS		 678 ARG_VERSION = 0x100,
679 ARG_PRIVATE_NETWORK,
bc2f673e 680 ARG_UUID,
5076f0cc 681 ARG_READ_ONLY,
57fb9fb5 682 ARG_CAPABILITY,
88fc9c9b 683 ARG_AMBIENT_CAPABILITY,
420c7379 684 ARG_DROP_CAPABILITY,
17fe0523
LP		 685 ARG_LINK_JOURNAL,
686 ARG_BIND,
f4889f65 687 ARG_BIND_RO,
06c17c39 688 ARG_TMPFS,
5a8af538
LP		 689 ARG_OVERLAY,
690 ARG_OVERLAY_RO,
de40a303 691 ARG_INACCESSIBLE,
eb91eb18 692 ARG_SHARE_SYSTEM,
89f7c846 693 ARG_REGISTER,
aa28aefe 694 ARG_KEEP_UNIT,
69c79d3c 695 ARG_NETWORK_INTERFACE,
c74e630d 696 ARG_NETWORK_MACVLAN,
4bbfe7ad 697 ARG_NETWORK_IPVLAN,
ab046dde 698 ARG_NETWORK_BRIDGE,
22b28dfd 699 ARG_NETWORK_ZONE,
f6d6bad1 700 ARG_NETWORK_VETH_EXTRA,
d7bea6b6 701 ARG_NETWORK_NAMESPACE_PATH,
6afc95b7 702 ARG_PERSONALITY,
4d9f07b4 703 ARG_VOLATILE,
ec16945e 704 ARG_TEMPLATE,
f36933fe 705 ARG_PROPERTY,
6dac160c 706 ARG_PRIVATE_USERS,
c6c8f6e2 707 ARG_KILL_SIGNAL,
f757855e 708 ARG_SETTINGS,
5f932eb9 709 ARG_CHDIR,
b53ede69 710 ARG_PIVOT_ROOT,
7336138e 711 ARG_PRIVATE_USERS_CHOWN,
6c045a99 712 ARG_PRIVATE_USERS_OWNERSHIP,
9c1e04d0 713 ARG_NOTIFY_READY,
4623e8e6 714 ARG_ROOT_HASH,
89e62e0b
LP		 715 ARG_ROOT_HASH_SIG,
716 ARG_VERITY_DATA,
960e4569 717 ARG_SYSTEM_CALL_FILTER,
bf428efb 718 ARG_RLIMIT,
3a9530e5 719 ARG_HOSTNAME,
66edd963 720 ARG_NO_NEW_PRIVILEGES,
81f345df 721 ARG_OOM_SCORE_ADJUST,
d107bb7d 722 ARG_CPU_AFFINITY,
09d423e9 723 ARG_RESOLV_CONF,
1688841f 724 ARG_TIMEZONE,
de40a303
LP		 725 ARG_CONSOLE,
726 ARG_PIPE,
727 ARG_OCI_BUNDLE,
bb068de0 728 ARG_NO_PAGER,
3652872a
LP		 729 ARG_SET_CREDENTIAL,
730 ARG_LOAD_CREDENTIAL,
2f893044 731 ARG_BIND_USER,
4a4654e0 732 ARG_SUPPRESS_SYNC,
a41fe3a2
LP		 733 };
734
88213476 735 static const struct option options[] = {
d7bea6b6
DP		 736 { "help", no_argument, NULL, 'h' },
737 { "version", no_argument, NULL, ARG_VERSION },
738 { "directory", required_argument, NULL, 'D' },
739 { "template", required_argument, NULL, ARG_TEMPLATE },
740 { "ephemeral", no_argument, NULL, 'x' },
741 { "user", required_argument, NULL, 'u' },
742 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
743 { "as-pid2", no_argument, NULL, 'a' },
744 { "boot", no_argument, NULL, 'b' },
745 { "uuid", required_argument, NULL, ARG_UUID },
746 { "read-only", no_argument, NULL, ARG_READ_ONLY },
747 { "capability", required_argument, NULL, ARG_CAPABILITY },
88fc9c9b 748 { "ambient-capability", required_argument, NULL, ARG_AMBIENT_CAPABILITY },
d7bea6b6 749 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
66edd963 750 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
d7bea6b6
DP		 751 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
752 { "bind", required_argument, NULL, ARG_BIND },
753 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
754 { "tmpfs", required_argument, NULL, ARG_TMPFS },
755 { "overlay", required_argument, NULL, ARG_OVERLAY },
756 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
de40a303 757 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
d7bea6b6 758 { "machine", required_argument, NULL, 'M' },
3a9530e5 759 { "hostname", required_argument, NULL, ARG_HOSTNAME },
d7bea6b6
DP		 760 { "slice", required_argument, NULL, 'S' },
761 { "setenv", required_argument, NULL, 'E' },
762 { "selinux-context", required_argument, NULL, 'Z' },
763 { "selinux-apifs-context", required_argument, NULL, 'L' },
764 { "quiet", no_argument, NULL, 'q' },
765 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
766 { "register", required_argument, NULL, ARG_REGISTER },
767 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
768 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
769 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
770 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
771 { "network-veth", no_argument, NULL, 'n' },
772 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
773 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
774 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
775 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
776 { "personality", required_argument, NULL, ARG_PERSONALITY },
777 { "image", required_argument, NULL, 'i' },
778 { "volatile", optional_argument, NULL, ARG_VOLATILE },
779 { "port", required_argument, NULL, 'p' },
780 { "property", required_argument, NULL, ARG_PROPERTY },
781 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
6c045a99
LP		 782 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN }, /* obsolete */
783 { "private-users-ownership",required_argument, NULL, ARG_PRIVATE_USERS_OWNERSHIP},
d7bea6b6
DP		 784 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
785 { "settings", required_argument, NULL, ARG_SETTINGS },
786 { "chdir", required_argument, NULL, ARG_CHDIR },
787 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
788 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
789 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
89e62e0b
LP		 790 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
791 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
d7bea6b6 792 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
bf428efb 793 { "rlimit", required_argument, NULL, ARG_RLIMIT },
81f345df 794 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
d107bb7d 795 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
09d423e9 796 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
1688841f 797 { "timezone", required_argument, NULL, ARG_TIMEZONE },
de40a303
LP		 798 { "console", required_argument, NULL, ARG_CONSOLE },
799 { "pipe", no_argument, NULL, ARG_PIPE },
800 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
bb068de0 801 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
3652872a
LP		 802 { "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
803 { "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
2f893044 804 { "bind-user", required_argument, NULL, ARG_BIND_USER },
4a4654e0 805 { "suppress-sync", required_argument, NULL, ARG_SUPPRESS_SYNC },
eb9da376 806 {}
88213476
LP		 807 };
808
9444b1f2 809 int c, r;
a42c8b54 810 uint64_t plus = 0, minus = 0;
f757855e 811 bool mask_all_settings = false, mask_no_settings = false;
88213476
LP		 812
813 assert(argc >= 0);
814 assert(argv);
815
de40a303 816 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
88213476
LP		 817 switch (c) {
818
819 case 'h':
37ec0fdd 820 return help();
88213476 821
acbeb427 822 case ARG_VERSION:
3f6fd1ba 823 return version();
acbeb427 824
88213476 825 case 'D':
614b022c 826 r = parse_path_argument(optarg, false, &arg_directory);
ec16945e 827 if (r < 0)
0f03c2a4 828 return r;
de40a303
LP		 829
830 arg_settings_mask |= SETTING_DIRECTORY;
ec16945e
LP		 831 break;
832
833 case ARG_TEMPLATE:
614b022c 834 r = parse_path_argument(optarg, false, &arg_template);
ec16945e 835 if (r < 0)
0f03c2a4 836 return r;
de40a303
LP		 837
838 arg_settings_mask |= SETTING_DIRECTORY;
88213476
LP		 839 break;
840
1b9e5b12 841 case 'i':
614b022c 842 r = parse_path_argument(optarg, false, &arg_image);
ec16945e 843 if (r < 0)
0f03c2a4 844 return r;
de40a303
LP		 845
846 arg_settings_mask |= SETTING_DIRECTORY;
847 break;
848
849 case ARG_OCI_BUNDLE:
614b022c 850 r = parse_path_argument(optarg, false, &arg_oci_bundle);
de40a303
LP		 851 if (r < 0)
852 return r;
853
ec16945e
LP		 854 break;
855
856 case 'x':
857 arg_ephemeral = true;
a2f577fc 858 arg_settings_mask |= SETTING_EPHEMERAL;
1b9e5b12
LP		 859 break;
860
687d0825 861 case 'u':
2fc09a9c
DM		 862 r = free_and_strdup(&arg_user, optarg);
863 if (r < 0)
7027ff61 864 return log_oom();
687d0825 865
f757855e 866 arg_settings_mask |= SETTING_USER;
687d0825
MV		 867 break;
868
22b28dfd
LP		 869 case ARG_NETWORK_ZONE: {
870 char *j;
871
b910cc72 872 j = strjoin("vz-", optarg);
22b28dfd
LP		 873 if (!j)
874 return log_oom();
875
876 if (!ifname_valid(j)) {
877 log_error("Network zone name not valid: %s", j);
878 free(j);
879 return -EINVAL;
880 }
881
df1fac6d 882 free_and_replace(arg_network_zone, j);
22b28dfd
LP		 883
884 arg_network_veth = true;
885 arg_private_network = true;
886 arg_settings_mask |= SETTING_NETWORK;
887 break;
888 }
889
ab046dde 890 case ARG_NETWORK_BRIDGE:
ef76dff2 891
baaa35ad
ZJS		 892 if (!ifname_valid(optarg))
893 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
894 "Bridge interface name not valid: %s", optarg);
ef76dff2 895
f757855e
LP		 896 r = free_and_strdup(&arg_network_bridge, optarg);
897 if (r < 0)
898 return log_oom();
ab046dde 899
4831981d 900 _fallthrough_;
0dfaa006 901 case 'n':
69c79d3c
LP		 902 arg_network_veth = true;
903 arg_private_network = true;
f757855e 904 arg_settings_mask |= SETTING_NETWORK;
69c79d3c
LP		 905 break;
906
f6d6bad1
LP		 907 case ARG_NETWORK_VETH_EXTRA:
908 r = veth_extra_parse(&arg_network_veth_extra, optarg);
909 if (r < 0)
910 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
911
912 arg_private_network = true;
913 arg_settings_mask |= SETTING_NETWORK;
914 break;
915
aa28aefe 916 case ARG_NETWORK_INTERFACE:
baaa35ad
ZJS		 917 if (!ifname_valid(optarg))
918 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
919 "Network interface name not valid: %s", optarg);
ef76dff2 920
b390f178
DDM		 921 r = test_network_interface_initialized(optarg);
922 if (r < 0)
923 return r;
924
c74e630d
LP		 925 if (strv_extend(&arg_network_interfaces, optarg) < 0)
926 return log_oom();
927
928 arg_private_network = true;
f757855e 929 arg_settings_mask |= SETTING_NETWORK;
c74e630d
LP		 930 break;
931
932 case ARG_NETWORK_MACVLAN:
ef76dff2 933
baaa35ad
ZJS		 934 if (!ifname_valid(optarg))
935 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
936 "MACVLAN network interface name not valid: %s", optarg);
ef76dff2 937
b390f178
DDM		 938 r = test_network_interface_initialized(optarg);
939 if (r < 0)
940 return r;
941
c74e630d 942 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 943 return log_oom();
944
4bbfe7ad 945 arg_private_network = true;
f757855e 946 arg_settings_mask |= SETTING_NETWORK;
4bbfe7ad
TG		 947 break;
948
949 case ARG_NETWORK_IPVLAN:
ef76dff2 950
baaa35ad
ZJS		 951 if (!ifname_valid(optarg))
952 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
953 "IPVLAN network interface name not valid: %s", optarg);
ef76dff2 954
b390f178
DDM		 955 r = test_network_interface_initialized(optarg);
956 if (r < 0)
957 return r;
958
4bbfe7ad
TG		 959 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
960 return log_oom();
961
4831981d 962 _fallthrough_;
ff01d048
LP		 963 case ARG_PRIVATE_NETWORK:
964 arg_private_network = true;
f757855e 965 arg_settings_mask |= SETTING_NETWORK;
a41fe3a2
LP		 966 break;
967
d7bea6b6 968 case ARG_NETWORK_NAMESPACE_PATH:
614b022c 969 r = parse_path_argument(optarg, false, &arg_network_namespace_path);
d7bea6b6
DP		 970 if (r < 0)
971 return r;
972
de40a303 973 arg_settings_mask |= SETTING_NETWORK;
d7bea6b6
DP		 974 break;
975
0f0dbc46 976 case 'b':
baaa35ad
ZJS		 977 if (arg_start_mode == START_PID2)
978 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
979 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 980
981 arg_start_mode = START_BOOT;
982 arg_settings_mask |= SETTING_START_MODE;
983 break;
984
985 case 'a':
baaa35ad
ZJS		 986 if (arg_start_mode == START_BOOT)
987 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
988 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 989
990 arg_start_mode = START_PID2;
991 arg_settings_mask |= SETTING_START_MODE;
0f0dbc46
LP		 992 break;
993
144f0fc0 994 case ARG_UUID:
9444b1f2 995 r = sd_id128_from_string(optarg, &arg_uuid);
317feb4d
LP		 996 if (r < 0)
997 return log_error_errno(r, "Invalid UUID: %s", optarg);
998
baaa35ad
ZJS		 999 if (sd_id128_is_null(arg_uuid))
1000 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1001 "Machine UUID may not be all zeroes.");
f757855e
LP		 1002
1003 arg_settings_mask |= SETTING_MACHINE_ID;
9444b1f2 1004 break;
aa96c6cb 1005
43c3fb46
LP		 1006 case 'S': {
1007 _cleanup_free_ char *mangled = NULL;
1008
1009 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
de40a303
LP		 1010 if (r < 0)
1011 return log_oom();
1012
43c3fb46 1013 free_and_replace(arg_slice, mangled);
de40a303 1014 arg_settings_mask |= SETTING_SLICE;
144f0fc0 1015 break;
43c3fb46 1016 }
144f0fc0 1017
7027ff61 1018 case 'M':
c1521918 1019 if (isempty(optarg))
97b11eed 1020 arg_machine = mfree(arg_machine);
c1521918 1021 else {
52ef5dd7 1022 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1023 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1024 "Invalid machine name: %s", optarg);
7027ff61 1025
0c3c4284
LP		 1026 r = free_and_strdup(&arg_machine, optarg);
1027 if (r < 0)
eb91eb18 1028 return log_oom();
eb91eb18 1029 }
9ce6d1b3 1030 break;
7027ff61 1031
3a9530e5
LP		 1032 case ARG_HOSTNAME:
1033 if (isempty(optarg))
1034 arg_hostname = mfree(arg_hostname);
1035 else {
52ef5dd7 1036 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1037 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1038 "Invalid hostname: %s", optarg);
3a9530e5
LP		 1039
1040 r = free_and_strdup(&arg_hostname, optarg);
1041 if (r < 0)
1042 return log_oom();
1043 }
1044
1045 arg_settings_mask |= SETTING_HOSTNAME;
1046 break;
1047
82adf6af
LP		 1048 case 'Z':
1049 arg_selinux_context = optarg;
a8828ed9
DW		 1050 break;
1051
82adf6af
LP		 1052 case 'L':
1053 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 1054 break;
1055
bc2f673e
LP		 1056 case ARG_READ_ONLY:
1057 arg_read_only = true;
f757855e 1058 arg_settings_mask |= SETTING_READ_ONLY;
bc2f673e
LP		 1059 break;
1060
88fc9c9b
TH		 1061 case ARG_AMBIENT_CAPABILITY: {
1062 uint64_t m;
1063 r = parse_capability_spec(optarg, &m);
1064 if (r <= 0)
1065 return r;
1066 arg_caps_ambient |= m;
1067 arg_settings_mask |= SETTING_CAPABILITY;
1068 break;
1069 }
420c7379
LP		 1070 case ARG_CAPABILITY:
1071 case ARG_DROP_CAPABILITY: {
8a99bd0c
ZJS		 1072 uint64_t m;
1073 r = parse_capability_spec(optarg, &m);
1074 if (r <= 0)
1075 return r;
5076f0cc 1076
8a99bd0c
ZJS		 1077 if (c == ARG_CAPABILITY)
1078 plus |= m;
1079 else
1080 minus |= m;
f757855e 1081 arg_settings_mask |= SETTING_CAPABILITY;
5076f0cc
LP		 1082 break;
1083 }
66edd963
LP		 1084 case ARG_NO_NEW_PRIVILEGES:
1085 r = parse_boolean(optarg);
1086 if (r < 0)
1087 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1088
1089 arg_no_new_privileges = r;
1090 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1091 break;
1092
57fb9fb5
LP		 1093 case 'j':
1094 arg_link_journal = LINK_GUEST;
574edc90 1095 arg_link_journal_try = true;
4e1d6aa9 1096 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1097 break;
1098
1099 case ARG_LINK_JOURNAL:
4e1d6aa9 1100 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
c6147113
LP		 1101 if (r < 0)
1102 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
57fb9fb5 1103
4e1d6aa9 1104 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1105 break;
1106
17fe0523 1107 case ARG_BIND:
f757855e
LP		 1108 case ARG_BIND_RO:
1109 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1110 if (r < 0)
1111 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
17fe0523 1112
f757855e 1113 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
17fe0523 1114 break;
06c17c39 1115
f757855e
LP		 1116 case ARG_TMPFS:
1117 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1118 if (r < 0)
1119 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
5a8af538 1120
f757855e 1121 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
5a8af538 1122 break;
5a8af538
LP		 1123
1124 case ARG_OVERLAY:
ad85779a
LP		 1125 case ARG_OVERLAY_RO:
1126 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1127 if (r == -EADDRNOTAVAIL)
1128 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1129 if (r < 0)
1130 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
06c17c39 1131
f757855e 1132 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
06c17c39 1133 break;
06c17c39 1134
de40a303
LP		 1135 case ARG_INACCESSIBLE:
1136 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1137 if (r < 0)
1138 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1139
1140 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1141 break;
1142
0d2a0179
ZJS		 1143 case 'E':
1144 r = strv_env_replace_strdup_passthrough(&arg_setenv, optarg);
aaf057c4 1145 if (r < 0)
0d2a0179 1146 return log_error_errno(r, "Cannot assign environment variable %s: %m", optarg);
f4889f65 1147
f757855e 1148 arg_settings_mask |= SETTING_ENVIRONMENT;
f4889f65 1149 break;
f4889f65 1150
284c0b91
LP		 1151 case 'q':
1152 arg_quiet = true;
1153 break;
1154
8a96d94e 1155 case ARG_SHARE_SYSTEM:
a6b5216c 1156 /* We don't officially support this anymore, except for compat reasons. People should use the
0c582db0 1157 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
63d1c29f 1158 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
0c582db0 1159 arg_clone_ns_flags = 0;
8a96d94e
LP		 1160 break;
1161
eb91eb18
LP		 1162 case ARG_REGISTER:
1163 r = parse_boolean(optarg);
1164 if (r < 0) {
1165 log_error("Failed to parse --register= argument: %s", optarg);
1166 return r;
1167 }
1168
1169 arg_register = r;
1170 break;
1171
89f7c846
LP		 1172 case ARG_KEEP_UNIT:
1173 arg_keep_unit = true;
1174 break;
1175
6afc95b7
LP		 1176 case ARG_PERSONALITY:
1177
ac45f971 1178 arg_personality = personality_from_string(optarg);
baaa35ad
ZJS		 1179 if (arg_personality == PERSONALITY_INVALID)
1180 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1181 "Unknown or unsupported personality '%s'.", optarg);
6afc95b7 1182
f757855e 1183 arg_settings_mask |= SETTING_PERSONALITY;
6afc95b7
LP		 1184 break;
1185
4d9f07b4
LP		 1186 case ARG_VOLATILE:
1187
1188 if (!optarg)
f757855e 1189 arg_volatile_mode = VOLATILE_YES;
5c828e66
LP		 1190 else if (streq(optarg, "help")) {
1191 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1192 return 0;
1193 } else {
f757855e 1194 VolatileMode m;
4d9f07b4 1195
f757855e 1196 m = volatile_mode_from_string(optarg);
baaa35ad
ZJS		 1197 if (m < 0)
1198 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1199 "Failed to parse --volatile= argument: %s", optarg);
1200 else
f757855e 1201 arg_volatile_mode = m;
6d0b55c2
LP		 1202 }
1203
f757855e
LP		 1204 arg_settings_mask |= SETTING_VOLATILE_MODE;
1205 break;
6d0b55c2 1206
f757855e
LP		 1207 case 'p':
1208 r = expose_port_parse(&arg_expose_ports, optarg);
1209 if (r == -EEXIST)
1210 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1211 if (r < 0)
1212 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
6d0b55c2 1213
f757855e 1214 arg_settings_mask |= SETTING_EXPOSE_PORTS;
6d0b55c2 1215 break;
6d0b55c2 1216
f36933fe
LP		 1217 case ARG_PROPERTY:
1218 if (strv_extend(&arg_property, optarg) < 0)
1219 return log_oom();
1220
1221 break;
1222
ae209204 1223 case ARG_PRIVATE_USERS: {
33eac552 1224 int boolean;
0de7acce 1225
ae209204
ZJS		 1226 if (!optarg)
1227 boolean = true;
1228 else if (!in_charset(optarg, DIGITS))
1229 /* do *not* parse numbers as booleans */
1230 boolean = parse_boolean(optarg);
33eac552
LP		 1231 else
1232 boolean = -1;
ae209204 1233
33eac552 1234 if (boolean == 0) {
0de7acce
LP		 1235 /* no: User namespacing off */
1236 arg_userns_mode = USER_NAMESPACE_NO;
1237 arg_uid_shift = UID_INVALID;
1238 arg_uid_range = UINT32_C(0x10000);
33eac552 1239 } else if (boolean > 0) {
0de7acce
LP		 1240 /* yes: User namespacing on, UID range is read from root dir */
1241 arg_userns_mode = USER_NAMESPACE_FIXED;
1242 arg_uid_shift = UID_INVALID;
1243 arg_uid_range = UINT32_C(0x10000);
1244 } else if (streq(optarg, "pick")) {
1245 /* pick: User namespacing on, UID range is picked randomly */
6c045a99
LP		 1246 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1247 * implied by USER_NAMESPACE_PICK
33eac552 1248 * further down. */
0de7acce
LP		 1249 arg_uid_shift = UID_INVALID;
1250 arg_uid_range = UINT32_C(0x10000);
33eac552
LP		 1251
1252 } else if (streq(optarg, "identity")) {
6c2d70ce 1253 /* identity: User namespaces on, UID range is map the 0…0xFFFF range to
33eac552
LP		 1254 * itself, i.e. we don't actually map anything, but do take benefit of
1255 * isolation of capability sets. */
1256 arg_userns_mode = USER_NAMESPACE_FIXED;
1257 arg_uid_shift = 0;
1258 arg_uid_range = UINT32_C(0x10000);
0de7acce 1259 } else {
6c2058b3 1260 _cleanup_free_ char *buffer = NULL;
6dac160c
LP		 1261 const char *range, *shift;
1262
0de7acce
LP		 1263 /* anything else: User namespacing on, UID range is explicitly configured */
1264
6dac160c
LP		 1265 range = strchr(optarg, ':');
1266 if (range) {
6c2058b3
ZJS		 1267 buffer = strndup(optarg, range - optarg);
1268 if (!buffer)
1269 return log_oom();
1270 shift = buffer;
6dac160c
LP		 1271
1272 range++;
bfd292ec
ZJS		 1273 r = safe_atou32(range, &arg_uid_range);
1274 if (r < 0)
be715731 1275 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
6dac160c
LP		 1276 } else
1277 shift = optarg;
1278
be715731
ZJS		 1279 r = parse_uid(shift, &arg_uid_shift);
1280 if (r < 0)
1281 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
0de7acce
LP		 1282
1283 arg_userns_mode = USER_NAMESPACE_FIXED;
6dac160c 1284
58e13de5
LP		 1285 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
1286 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID range cannot be empty or go beyond " UID_FMT ".", UID_INVALID);
1287 }
be715731 1288
0de7acce 1289 arg_settings_mask |= SETTING_USERNS;
6dac160c 1290 break;
ae209204 1291 }
6dac160c 1292
0de7acce 1293 case 'U':
ccabee0d 1294 if (userns_supported()) {
6c045a99
LP		 1295 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1296 * implied by USER_NAMESPACE_PICK
33eac552 1297 * further down. */
ccabee0d
LP		 1298 arg_uid_shift = UID_INVALID;
1299 arg_uid_range = UINT32_C(0x10000);
1300
1301 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1302 }
1303
7336138e
LP		 1304 break;
1305
0de7acce 1306 case ARG_PRIVATE_USERS_CHOWN:
6c045a99
LP		 1307 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
1308
1309 arg_settings_mask |= SETTING_USERNS;
1310 break;
1311
1312 case ARG_PRIVATE_USERS_OWNERSHIP:
1313 if (streq(optarg, "help")) {
1314 DUMP_STRING_TABLE(user_namespace_ownership, UserNamespaceOwnership, _USER_NAMESPACE_OWNERSHIP_MAX);
1315 return 0;
1316 }
1317
1318 arg_userns_ownership = user_namespace_ownership_from_string(optarg);
1319 if (arg_userns_ownership < 0)
1320 return log_error_errno(arg_userns_ownership, "Cannot parse --user-namespace-ownership= value: %s", optarg);
0de7acce
LP		 1321
1322 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1323 break;
1324
c6c8f6e2 1325 case ARG_KILL_SIGNAL:
5c828e66
LP		 1326 if (streq(optarg, "help")) {
1327 DUMP_STRING_TABLE(signal, int, _NSIG);
1328 return 0;
1329 }
1330
29a3db75 1331 arg_kill_signal = signal_from_string(optarg);
baaa35ad 1332 if (arg_kill_signal < 0)
7211c853 1333 return log_error_errno(arg_kill_signal, "Cannot parse signal: %s", optarg);
c6c8f6e2 1334
f757855e
LP		 1335 arg_settings_mask |= SETTING_KILL_SIGNAL;
1336 break;
1337
1338 case ARG_SETTINGS:
1339
1340 /* no → do not read files
1341 * yes → read files, do not override cmdline, trust only subset
1342 * override → read files, override cmdline, trust only subset
1343 * trusted → read files, do not override cmdline, trust all
1344 */
1345
1346 r = parse_boolean(optarg);
1347 if (r < 0) {
1348 if (streq(optarg, "trusted")) {
1349 mask_all_settings = false;
1350 mask_no_settings = false;
1351 arg_settings_trusted = true;
1352
1353 } else if (streq(optarg, "override")) {
1354 mask_all_settings = false;
1355 mask_no_settings = true;
1356 arg_settings_trusted = -1;
1357 } else
1358 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1359 } else if (r > 0) {
1360 /* yes */
1361 mask_all_settings = false;
1362 mask_no_settings = false;
1363 arg_settings_trusted = -1;
1364 } else {
1365 /* no */
1366 mask_all_settings = true;
1367 mask_no_settings = false;
1368 arg_settings_trusted = false;
1369 }
1370
c6c8f6e2
LP		 1371 break;
1372
5f932eb9 1373 case ARG_CHDIR:
baaa35ad
ZJS		 1374 if (!path_is_absolute(optarg))
1375 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1376 "Working directory %s is not an absolute path.", optarg);
5f932eb9
LP		 1377
1378 r = free_and_strdup(&arg_chdir, optarg);
1379 if (r < 0)
1380 return log_oom();
1381
1382 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1383 break;
1384
b53ede69
PW		 1385 case ARG_PIVOT_ROOT:
1386 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1387 if (r < 0)
1388 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1389
1390 arg_settings_mask |= SETTING_PIVOT_ROOT;
1391 break;
1392
9c1e04d0
AP		 1393 case ARG_NOTIFY_READY:
1394 r = parse_boolean(optarg);
baaa35ad
ZJS		 1395 if (r < 0)
1396 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1397 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
9c1e04d0
AP		 1398 arg_notify_ready = r;
1399 arg_settings_mask |= SETTING_NOTIFY_READY;
1400 break;
1401
4623e8e6 1402 case ARG_ROOT_HASH: {
89e62e0b 1403 _cleanup_free_ void *k = NULL;
4623e8e6
LP		 1404 size_t l;
1405
1406 r = unhexmem(optarg, strlen(optarg), &k, &l);
1407 if (r < 0)
1408 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
89e62e0b 1409 if (l < sizeof(sd_id128_t))
c6147113 1410 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
4623e8e6 1411
89e62e0b
LP		 1412 free_and_replace(arg_verity_settings.root_hash, k);
1413 arg_verity_settings.root_hash_size = l;
4623e8e6
LP		 1414 break;
1415 }
1416
c2923fdc
LB		 1417 case ARG_ROOT_HASH_SIG: {
1418 char *value;
89e62e0b
LP		 1419 size_t l;
1420 void *p;
c2923fdc
LB		 1421
1422 if ((value = startswith(optarg, "base64:"))) {
c2923fdc
LB		 1423 r = unbase64mem(value, strlen(value), &p, &l);
1424 if (r < 0)
1425 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1426
c2923fdc 1427 } else {
89e62e0b 1428 r = read_full_file(optarg, (char**) &p, &l);
c2923fdc 1429 if (r < 0)
89e62e0b 1430 return log_error_errno(r, "Failed parse root hash signature file '%s': %m", optarg);
c2923fdc
LB		 1431 }
1432
89e62e0b
LP		 1433 free_and_replace(arg_verity_settings.root_hash_sig, p);
1434 arg_verity_settings.root_hash_sig_size = l;
c2923fdc
LB		 1435 break;
1436 }
1437
89e62e0b 1438 case ARG_VERITY_DATA:
614b022c 1439 r = parse_path_argument(optarg, false, &arg_verity_settings.data_path);
89e62e0b
LP		 1440 if (r < 0)
1441 return r;
1442 break;
1443
960e4569
LP		 1444 case ARG_SYSTEM_CALL_FILTER: {
1445 bool negative;
1446 const char *items;
1447
1448 negative = optarg[0] == '~';
1449 items = negative ? optarg + 1 : optarg;
1450
1451 for (;;) {
1452 _cleanup_free_ char *word = NULL;
1453
1454 r = extract_first_word(&items, &word, NULL, 0);
1455 if (r == 0)
1456 break;
1457 if (r == -ENOMEM)
1458 return log_oom();
1459 if (r < 0)
1460 return log_error_errno(r, "Failed to parse system call filter: %m");
1461
1462 if (negative)
6b000af4 1463 r = strv_extend(&arg_syscall_deny_list, word);
960e4569 1464 else
6b000af4 1465 r = strv_extend(&arg_syscall_allow_list, word);
960e4569
LP		 1466 if (r < 0)
1467 return log_oom();
1468 }
1469
1470 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1471 break;
1472 }
1473
bf428efb
LP		 1474 case ARG_RLIMIT: {
1475 const char *eq;
622ecfa8 1476 _cleanup_free_ char *name = NULL;
bf428efb
LP		 1477 int rl;
1478
5c828e66
LP		 1479 if (streq(optarg, "help")) {
1480 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1481 return 0;
1482 }
1483
bf428efb 1484 eq = strchr(optarg, '=');
baaa35ad
ZJS		 1485 if (!eq)
1486 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1487 "--rlimit= expects an '=' assignment.");
bf428efb
LP		 1488
1489 name = strndup(optarg, eq - optarg);
1490 if (!name)
1491 return log_oom();
1492
1493 rl = rlimit_from_string_harder(name);
baaa35ad 1494 if (rl < 0)
7211c853 1495 return log_error_errno(rl, "Unknown resource limit: %s", name);
bf428efb
LP		 1496
1497 if (!arg_rlimit[rl]) {
1498 arg_rlimit[rl] = new0(struct rlimit, 1);
1499 if (!arg_rlimit[rl])
1500 return log_oom();
1501 }
1502
1503 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1504 if (r < 0)
1505 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1506
1507 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1508 break;
1509 }
1510
81f345df
LP		 1511 case ARG_OOM_SCORE_ADJUST:
1512 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1513 if (r < 0)
1514 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1515
1516 arg_oom_score_adjust_set = true;
1517 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1518 break;
1519
d107bb7d 1520 case ARG_CPU_AFFINITY: {
0985c7c4 1521 CPUSet cpuset;
d107bb7d
LP		 1522
1523 r = parse_cpu_set(optarg, &cpuset);
1524 if (r < 0)
0985c7c4 1525 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
d107bb7d 1526
0985c7c4
ZJS		 1527 cpu_set_reset(&arg_cpu_set);
1528 arg_cpu_set = cpuset;
d107bb7d
LP		 1529 arg_settings_mask |= SETTING_CPU_AFFINITY;
1530 break;
1531 }
1532
09d423e9
LP		 1533 case ARG_RESOLV_CONF:
1534 if (streq(optarg, "help")) {
1535 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1536 return 0;
1537 }
1538
1539 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
baaa35ad 1540 if (arg_resolv_conf < 0)
7211c853 1541 return log_error_errno(arg_resolv_conf,
baaa35ad 1542 "Failed to parse /etc/resolv.conf mode: %s", optarg);
09d423e9
LP		 1543
1544 arg_settings_mask |= SETTING_RESOLV_CONF;
1545 break;
1546
1688841f
LP		 1547 case ARG_TIMEZONE:
1548 if (streq(optarg, "help")) {
1549 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1550 return 0;
1551 }
1552
1553 arg_timezone = timezone_mode_from_string(optarg);
baaa35ad 1554 if (arg_timezone < 0)
7211c853 1555 return log_error_errno(arg_timezone,
baaa35ad 1556 "Failed to parse /etc/localtime mode: %s", optarg);
1688841f
LP		 1557
1558 arg_settings_mask |= SETTING_TIMEZONE;
1559 break;
1560
de40a303 1561 case ARG_CONSOLE:
dce66ffe
ZJS		 1562 r = handle_arg_console(optarg);
1563 if (r <= 0)
1564 return r;
de40a303
LP		 1565 break;
1566
1567 case 'P':
1568 case ARG_PIPE:
dce66ffe
ZJS		 1569 r = handle_arg_console("pipe");
1570 if (r <= 0)
1571 return r;
de40a303
LP		 1572 break;
1573
bb068de0
ZJS		 1574 case ARG_NO_PAGER:
1575 arg_pager_flags |= PAGER_DISABLE;
1576 break;
1577
3652872a
LP		 1578 case ARG_SET_CREDENTIAL: {
1579 _cleanup_free_ char *word = NULL, *data = NULL;
1580 const char *p = optarg;
1581 Credential *a;
e437538f 1582 ssize_t l;
3652872a
LP		 1583
1584 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1585 if (r == -ENOMEM)
1586 return log_oom();
1587 if (r < 0)
1588 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1589 if (r == 0 || !p)
1590 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1591
1592 if (!credential_name_valid(word))
1593 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1594
12d729b2 1595 for (size_t i = 0; i < arg_n_credentials; i++)
3652872a
LP		 1596 if (streq(arg_credentials[i].id, word))
1597 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1598
1599 l = cunescape(p, UNESCAPE_ACCEPT_NUL, &data);
1600 if (l < 0)
1601 return log_error_errno(l, "Failed to unescape credential data: %s", p);
1602
1603 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1604 if (!a)
1605 return log_oom();
1606
1607 a[arg_n_credentials++] = (Credential) {
1608 .id = TAKE_PTR(word),
1609 .data = TAKE_PTR(data),
1610 .size = l,
1611 };
1612
1613 arg_credentials = a;
1614
1615 arg_settings_mask |= SETTING_CREDENTIALS;
1616 break;
1617 }
1618
1619 case ARG_LOAD_CREDENTIAL: {
1620 ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
1621 _cleanup_(erase_and_freep) char *data = NULL;
1622 _cleanup_free_ char *word = NULL, *j = NULL;
1623 const char *p = optarg;
1624 Credential *a;
1625 size_t size, i;
1626
1627 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1628 if (r == -ENOMEM)
1629 return log_oom();
1630 if (r < 0)
c941b650 1631 return log_error_errno(r, "Failed to parse --load-credential= parameter: %m");
3652872a 1632 if (r == 0 || !p)
c941b650 1633 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --load-credential=: %s", optarg);
3652872a
LP		 1634
1635 if (!credential_name_valid(word))
1636 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1637
1638 for (i = 0; i < arg_n_credentials; i++)
1639 if (streq(arg_credentials[i].id, word))
1640 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1641
1642 if (path_is_absolute(p))
1643 flags |= READ_FULL_FILE_CONNECT_SOCKET;
1644 else {
1645 const char *e;
1646
786d19fd
LP		 1647 r = get_credentials_dir(&e);
1648 if (r < 0)
1649 return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
3652872a
LP		 1650
1651 j = path_join(e, p);
1652 if (!j)
1653 return log_oom();
1654 }
1655
986311c2
LP		 1656 r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
1657 flags,
1658 NULL,
1659 &data, &size);
3652872a
LP		 1660 if (r < 0)
1661 return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
1662
1663 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1664 if (!a)
1665 return log_oom();
1666
1667 a[arg_n_credentials++] = (Credential) {
1668 .id = TAKE_PTR(word),
1669 .data = TAKE_PTR(data),
1670 .size = size,
1671 };
1672
1673 arg_credentials = a;
1674
1675 arg_settings_mask |= SETTING_CREDENTIALS;
1676 break;
1677 }
1678
2f893044
LP		 1679 case ARG_BIND_USER:
1680 if (!valid_user_group_name(optarg, 0))
1681 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid user name to bind: %s", optarg);
1682
1683 if (strv_extend(&arg_bind_user, optarg) < 0)
1684 return log_oom();
1685
1686 arg_settings_mask |= SETTING_BIND_USER;
1687 break;
1688
4a4654e0
LP		 1689 case ARG_SUPPRESS_SYNC:
1690 r = parse_boolean_argument("--suppress-sync=", optarg, &arg_suppress_sync);
1691 if (r < 0)
1692 return r;
1693
1694 arg_settings_mask |= SETTING_SUPPRESS_SYNC;
1695 break;
1696
88213476
LP		 1697 case '?':
1698 return -EINVAL;
1699
1700 default:
04499a70 1701 assert_not_reached();
88213476 1702 }
88213476 1703
60f1ec13
LP		 1704 if (argc > optind) {
1705 strv_free(arg_parameters);
1706 arg_parameters = strv_copy(argv + optind);
1707 if (!arg_parameters)
1708 return log_oom();
d7bea6b6 1709
60f1ec13
LP		 1710 arg_settings_mask |= SETTING_START_MODE;
1711 }
1712
1713 if (arg_ephemeral && arg_template && !arg_directory)
1714 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1715 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1716 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1717 * --directory=". */
1718 arg_directory = TAKE_PTR(arg_template);
1719
bd4b15f2 1720 arg_caps_retain = (arg_caps_retain | plus | (arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0)) & ~minus;
60f1ec13 1721
de40a303 1722 /* Make sure to parse environment before we reset the settings mask below */
49048684
ZJS		 1723 r = parse_environment();
1724 if (r < 0)
1725 return r;
de40a303 1726
60f1ec13
LP		 1727 /* Load all settings from .nspawn files */
1728 if (mask_no_settings)
1729 arg_settings_mask = 0;
1730
1731 /* Don't load any settings from .nspawn files */
1732 if (mask_all_settings)
1733 arg_settings_mask = _SETTINGS_MASK_ALL;
1734
1735 return 1;
1736}
1737
1738static int verify_arguments(void) {
1739 int r;
a6b5216c 1740
75b0d8b8
ZJS		 1741 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1742 /* If we are running the stub init in the container, we don't need to look at what the init
1743 * in the container supports, because we are not using it. Let's immediately pick the right
1744 * setting based on the host system configuration.
1745 *
1746 * We only do this, if the user didn't use an environment variable to override the detection.
1747 */
1748
1749 r = cg_all_unified();
1750 if (r < 0)
1751 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1752 if (r > 0)
1753 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1754 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1755 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1756 else
1757 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1758 }
1759
4f086aab
SU		 1760 if (arg_userns_mode != USER_NAMESPACE_NO)
1761 arg_mount_settings |= MOUNT_USE_USERNS;
1762
1763 if (arg_private_network)
1764 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1765
48a8d337
LB		 1766 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1767 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
eb91eb18 1768 arg_register = false;
baaa35ad 1769 if (arg_start_mode != START_PID1)
60f1ec13 1770 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
0c582db0 1771 }
eb91eb18 1772
6c045a99
LP		 1773 if (arg_userns_ownership < 0)
1774 arg_userns_ownership =
f61c7f88 1775 arg_userns_mode == USER_NAMESPACE_PICK ? USER_NAMESPACE_OWNERSHIP_AUTO :
6c045a99 1776 USER_NAMESPACE_OWNERSHIP_OFF;
0e7ac751 1777
60f1ec13
LP		 1778 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1779 arg_kill_signal = SIGRTMIN+3;
1780
e5a4bb0d
LP		 1781 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1782 arg_read_only = true;
1783
2436ea76
DDM		 1784 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1785 arg_read_only = true;
1786
baaa35ad 1787 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
8d9c2bca
AJ		 1788 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1789 * The latter is not technically a user session, but we don't need to labour the point. */
60f1ec13 1790 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
89f7c846 1791
baaa35ad 1792 if (arg_directory && arg_image)
60f1ec13 1793 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1b9e5b12 1794
baaa35ad 1795 if (arg_template && arg_image)
60f1ec13 1796 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
8cd328d8 1797
baaa35ad 1798 if (arg_template && !(arg_directory || arg_machine))
60f1ec13 1799 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
ec16945e 1800
baaa35ad 1801 if (arg_ephemeral && arg_template)
60f1ec13 1802 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
ec16945e 1803
baaa35ad 1804 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
60f1ec13 1805 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
df9a75e4 1806
baaa35ad 1807 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
60f1ec13 1808 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
7336138e 1809
6c045a99 1810 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_read_only)
de40a303 1811 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
6c045a99 1812 "--read-only and --private-users-ownership=chown may not be combined.");
f757855e 1813
6c045a99
LP		 1814 /* We don't support --private-users-ownership=chown together with any of the volatile modes since we
1815 * couldn't change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a
1816 * massive copy-up (in case of overlay) making the entire exercise pointless. */
1817 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_volatile_mode != VOLATILE_NO)
1818 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-ownership=chown may not be combined.");
e5a4bb0d 1819
679ecd36
SZ		 1820 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1821 * we need to error out, to avoid conflicts between different network options. */
60f1ec13
LP		 1822 if (arg_network_namespace_path &&
1823 (arg_network_interfaces || arg_network_macvlan ||
1824 arg_network_ipvlan || arg_network_veth_extra ||
1825 arg_network_bridge || arg_network_zone ||
679ecd36 1826 arg_network_veth))
de40a303 1827 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
86c0dd4a 1828
60f1ec13 1829 if (arg_network_bridge && arg_network_zone)
de40a303
LP		 1830 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1831 "--network-bridge= and --network-zone= may not be combined.");
f757855e 1832
baaa35ad 1833 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
60f1ec13 1834 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
4f086aab 1835
baaa35ad 1836 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
60f1ec13 1837 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
f757855e 1838
baaa35ad 1839 if (arg_expose_ports && !arg_private_network)
60f1ec13 1840 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
6d0b55c2 1841
88fc9c9b 1842 if (arg_caps_ambient) {
f5fbe71d 1843 if (arg_caps_ambient == UINT64_MAX)
88fc9c9b
TH		 1844 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= does not support the value all.");
1845
1846 if ((arg_caps_ambient & arg_caps_retain) != arg_caps_ambient)
1847 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not fully covered by Capability= setting.");
1848
1849 if (arg_start_mode == START_BOOT)
1850 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not useful for boot mode.");
1851 }
1852
2f893044
LP		 1853 if (arg_userns_mode == USER_NAMESPACE_NO && !strv_isempty(arg_bind_user))
1854 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--bind-user= requires --private-users");
1855
1856 /* Drop duplicate --bind-user= entries */
1857 strv_uniq(arg_bind_user);
1858
60f1ec13
LP		 1859 r = custom_mount_check_all();
1860 if (r < 0)
1861 return r;
c6c8f6e2 1862
f757855e 1863 return 0;
88213476
LP		 1864}
1865
91181e07 1866int userns_lchown(const char *p, uid_t uid, gid_t gid) {
03cfe0d5
LP		 1867 assert(p);
1868
0de7acce 1869 if (arg_userns_mode == USER_NAMESPACE_NO)
03cfe0d5
LP		 1870 return 0;
1871
1872 if (uid == UID_INVALID && gid == GID_INVALID)
1873 return 0;
1874
1875 if (uid != UID_INVALID) {
1876 uid += arg_uid_shift;
1877
1878 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1879 return -EOVERFLOW;
1880 }
1881
1882 if (gid != GID_INVALID) {
1883 gid += (gid_t) arg_uid_shift;
1884
1885 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1886 return -EOVERFLOW;
1887 }
1888
7c248223 1889 return RET_NERRNO(lchown(p, uid, gid));
b12afc8c
LP		 1890}
1891
91181e07 1892int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
03cfe0d5 1893 const char *q;
dae8b82e 1894 int r;
03cfe0d5
LP		 1895
1896 q = prefix_roota(root, path);
3f692e2e 1897 r = RET_NERRNO(mkdir(q, mode));
dae8b82e
ZJS		 1898 if (r == -EEXIST)
1899 return 0;
1900 if (r < 0)
1901 return r;
03cfe0d5
LP		 1902
1903 return userns_lchown(q, uid, gid);
1904}
1905
1688841f 1906static const char *timezone_from_path(const char *path) {
da9fc98d
LP		 1907 return PATH_STARTSWITH_SET(
1908 path,
1909 "../usr/share/zoneinfo/",
1910 "/usr/share/zoneinfo/");
1688841f
LP		 1911}
1912
83205269
LP		 1913static bool etc_writable(void) {
1914 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1915}
1916
e58a1277 1917static int setup_timezone(const char *dest) {
1688841f
LP		 1918 _cleanup_free_ char *p = NULL, *etc = NULL;
1919 const char *where, *check;
1920 TimezoneMode m;
d4036145 1921 int r;
f8440af5 1922
e58a1277
LP		 1923 assert(dest);
1924
1688841f 1925 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1688841f
LP		 1926 r = readlink_malloc("/etc/localtime", &p);
1927 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
83205269 1928 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1688841f 1929 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
83205269 1930 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1688841f
LP		 1931 else if (r < 0) {
1932 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1933 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1934 * file.
1935 *
1936 * Example:
1937 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1938 */
1939 return 0;
1940 } else if (arg_timezone == TIMEZONE_AUTO)
83205269 1941 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1688841f
LP		 1942 else
1943 m = arg_timezone;
1944 } else
1945 m = arg_timezone;
1946
1947 if (m == TIMEZONE_OFF)
1948 return 0;
1949
a5648b80 1950 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
d4036145 1951 if (r < 0) {
1688841f 1952 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
d4036145
LP		 1953 return 0;
1954 }
1955
1688841f
LP		 1956 where = strjoina(etc, "/localtime");
1957
1958 switch (m) {
1959
1960 case TIMEZONE_DELETE:
1961 if (unlink(where) < 0)
1962 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1963
d4036145 1964 return 0;
d4036145 1965
1688841f
LP		 1966 case TIMEZONE_SYMLINK: {
1967 _cleanup_free_ char *q = NULL;
1968 const char *z, *what;
4d1c38b8 1969
1688841f
LP		 1970 z = timezone_from_path(p);
1971 if (!z) {
1972 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
d4036145 1973 return 0;
1688841f 1974 }
d4036145 1975
1688841f
LP		 1976 r = readlink_malloc(where, &q);
1977 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1978 return 0; /* Already pointing to the right place? Then do nothing .. */
1979
1980 check = strjoina(dest, "/usr/share/zoneinfo/", z);
a5648b80 1981 r = chase_symlinks(check, dest, 0, NULL, NULL);
1688841f
LP		 1982 if (r < 0)
1983 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1984 else {
1985 if (unlink(where) < 0 && errno != ENOENT) {
1986 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1987 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1988 return 0;
1989 }
1990
1991 what = strjoina("../usr/share/zoneinfo/", z);
1992 if (symlink(what, where) < 0) {
1993 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
1994 errno, "Failed to correct timezone of container, ignoring: %m");
1995 return 0;
1996 }
1997
1998 break;
1999 }
2000
2001 _fallthrough_;
d4036145 2002 }
68fb0892 2003
1688841f
LP		 2004 case TIMEZONE_BIND: {
2005 _cleanup_free_ char *resolved = NULL;
2006 int found;
2007
a5648b80 2008 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
1688841f
LP		 2009 if (found < 0) {
2010 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
2011 return 0;
2012 }
2013
2014 if (found == 0) /* missing? */
2015 (void) touch(resolved);
2016
511a8cfe 2017 r = mount_nofollow_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
1688841f 2018 if (r >= 0)
511a8cfe 2019 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
1688841f
LP		 2020
2021 _fallthrough_;
79d80fc1 2022 }
4d9f07b4 2023
1688841f
LP		 2024 case TIMEZONE_COPY:
2025 /* If mounting failed, try to copy */
8a016c74 2026 r = copy_file_atomic("/etc/localtime", where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
1688841f
LP		 2027 if (r < 0) {
2028 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2029 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
2030 return 0;
2031 }
2032
2033 break;
2034
2035 default:
04499a70 2036 assert_not_reached();
d4036145 2037 }
e58a1277 2038
1688841f 2039 /* Fix permissions of the symlink or file copy we just created */
03cfe0d5
LP		 2040 r = userns_lchown(where, 0, 0);
2041 if (r < 0)
1688841f 2042 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
03cfe0d5 2043
e58a1277 2044 return 0;
88213476
LP		 2045}
2046
09d423e9
LP		 2047static int have_resolv_conf(const char *path) {
2048 assert(path);
2049
2050 if (access(path, F_OK) < 0) {
2051 if (errno == ENOENT)
2052 return 0;
2053
2054 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
2055 }
2056
2057 return 1;
2058}
2059
7357272e 2060static int resolved_listening(void) {
b8ea7a6e 2061 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
b053cd5f 2062 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
7357272e 2063 _cleanup_free_ char *dns_stub_listener_mode = NULL;
b053cd5f
LP		 2064 int r;
2065
7357272e 2066 /* Check if resolved is listening */
b053cd5f
LP		 2067
2068 r = sd_bus_open_system(&bus);
2069 if (r < 0)
b8ea7a6e 2070 return log_debug_errno(r, "Failed to open system bus: %m");
b053cd5f 2071
7357272e 2072 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
b8ea7a6e
LP		 2073 if (r < 0)
2074 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
2075 if (r == 0)
2076 return 0;
7357272e
DM		 2077
2078 r = sd_bus_get_property_string(bus,
2079 "org.freedesktop.resolve1",
2080 "/org/freedesktop/resolve1",
2081 "org.freedesktop.resolve1.Manager",
2082 "DNSStubListener",
b8ea7a6e 2083 &error,
7357272e
DM		 2084 &dns_stub_listener_mode);
2085 if (r < 0)
b8ea7a6e 2086 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
7357272e
DM		 2087
2088 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
b053cd5f
LP		 2089}
2090
2547bb41 2091static int setup_resolv_conf(const char *dest) {
09d423e9
LP		 2092 _cleanup_free_ char *etc = NULL;
2093 const char *where, *what;
2094 ResolvConfMode m;
2095 int r;
2547bb41
LP		 2096
2097 assert(dest);
2098
09d423e9
LP		 2099 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
2100 if (arg_private_network)
2101 m = RESOLV_CONF_OFF;
86775e35
LP		 2102 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
2103 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
09d423e9 2104 else if (have_resolv_conf("/etc/resolv.conf") > 0)
83205269 2105 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
09d423e9 2106 else
83205269 2107 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
86775e35 2108
09d423e9
LP		 2109 } else
2110 m = arg_resolv_conf;
2111
2112 if (m == RESOLV_CONF_OFF)
2547bb41
LP		 2113 return 0;
2114
a5648b80 2115 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
87447ae4
LP		 2116 if (r < 0) {
2117 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
2118 return 0;
2119 }
2120
2121 where = strjoina(etc, "/resolv.conf");
09d423e9
LP		 2122
2123 if (m == RESOLV_CONF_DELETE) {
2124 if (unlink(where) < 0)
2125 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
2126
87447ae4
LP		 2127 return 0;
2128 }
79d80fc1 2129
86775e35
LP		 2130 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
2131 what = PRIVATE_STATIC_RESOLV_CONF;
2132 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
2133 what = PRIVATE_UPLINK_RESOLV_CONF;
2134 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
2135 what = PRIVATE_STUB_RESOLV_CONF;
09d423e9
LP		 2136 else
2137 what = "/etc/resolv.conf";
87447ae4 2138
86775e35 2139 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
09d423e9
LP		 2140 _cleanup_free_ char *resolved = NULL;
2141 int found;
2142
a5648b80 2143 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
09d423e9
LP		 2144 if (found < 0) {
2145 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
2146 return 0;
2147 }
3539724c 2148
87447ae4
LP		 2149 if (found == 0) /* missing? */
2150 (void) touch(resolved);
5367354d 2151
511a8cfe 2152 r = mount_nofollow_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
60e76d48 2153 if (r >= 0)
511a8cfe 2154 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
86775e35
LP		 2155
2156 /* If that didn't work, let's copy the file */
3539724c
LP		 2157 }
2158
86775e35
LP		 2159 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
2160 r = copy_file_atomic(what, where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
2161 else
2162 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, 0, 0, COPY_REFLINK);
79d80fc1 2163 if (r < 0) {
3539724c
LP		 2164 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
2165 * resolved or something similar runs inside and the symlink points there.
68a313c5 2166 *
3539724c 2167 * If the disk image is read-only, there's also no point in complaining.
68a313c5 2168 */
86775e35
LP		 2169 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
2170 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
3539724c 2171 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
79d80fc1
TG		 2172 return 0;
2173 }
2547bb41 2174
03cfe0d5
LP		 2175 r = userns_lchown(where, 0, 0);
2176 if (r < 0)
3539724c 2177 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
03cfe0d5 2178
2547bb41
LP		 2179 return 0;
2180}
2181
1e4f1671 2182static int setup_boot_id(void) {
cdde6ba6
LP		 2183 _cleanup_(unlink_and_freep) char *from = NULL;
2184 _cleanup_free_ char *path = NULL;
3bbaff3e 2185 sd_id128_t rnd = SD_ID128_NULL;
cdde6ba6 2186 const char *to;
04bc4a3f
LP		 2187 int r;
2188
1eacc470 2189 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
04bc4a3f 2190
1eacc470 2191 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
cdde6ba6
LP		 2192 if (r < 0)
2193 return log_error_errno(r, "Failed to generate random boot ID path: %m");
04bc4a3f
LP		 2194
2195 r = sd_id128_randomize(&rnd);
f647962d
MS		 2196 if (r < 0)
2197 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 2198
b40c8ebd 2199 r = id128_write(path, ID128_FORMAT_UUID, rnd);
f647962d
MS		 2200 if (r < 0)
2201 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 2202
cdde6ba6
LP		 2203 from = TAKE_PTR(path);
2204 to = "/proc/sys/kernel/random/boot_id";
2205
511a8cfe 2206 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
cdde6ba6
LP		 2207 if (r < 0)
2208 return r;
04bc4a3f 2209
511a8cfe 2210 return mount_nofollow_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
04bc4a3f
LP		 2211}
2212
e58a1277 2213static int copy_devnodes(const char *dest) {
88213476
LP		 2214 static const char devnodes[] =
2215 "null\0"
2216 "zero\0"
2217 "full\0"
2218 "random\0"
2219 "urandom\0"
85614d66
TG		 2220 "tty\0"
2221 "net/tun\0";
88213476 2222
e58a1277 2223 int r = 0;
a258bf26
LP		 2224
2225 assert(dest);
124640f1 2226
52f05ef2 2227 BLOCK_WITH_UMASK(0000);
88213476 2228
03cfe0d5
LP		 2229 /* Create /dev/net, so that we can create /dev/net/tun in it */
2230 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2231 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2232
88213476 2233 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 2234 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 2235 struct stat st;
88213476 2236
c6134d3e 2237 from = path_join("/dev/", d);
8967f291
LP		 2238 if (!from)
2239 return log_oom();
2240
c6134d3e 2241 to = path_join(dest, from);
8967f291
LP		 2242 if (!to)
2243 return log_oom();
88213476
LP		 2244
2245 if (stat(from, &st) < 0) {
2246
4a62c710
MS		 2247 if (errno != ENOENT)
2248 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 2249
baaa35ad
ZJS		 2250 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2251 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2252 "%s is not a char or block device, cannot copy.", from);
2253 else {
8dfce114
LP		 2254 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2255
81f5049b 2256 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
8dbf71ec 2257 /* Explicitly warn the user when /dev is already populated. */
41eb4362 2258 if (errno == EEXIST)
8dbf71ec 2259 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
81f5049b
AC		 2260 if (errno != EPERM)
2261 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2262
8dfce114 2263 /* Some systems abusively restrict mknod but allow bind mounts. */
81f5049b
AC		 2264 r = touch(to);
2265 if (r < 0)
2266 return log_error_errno(r, "touch (%s) failed: %m", to);
511a8cfe 2267 r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2268 if (r < 0)
2269 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
81f5049b 2270 }
6278cf60 2271
03cfe0d5
LP		 2272 r = userns_lchown(to, 0, 0);
2273 if (r < 0)
2274 return log_error_errno(r, "chown() of device node %s failed: %m", to);
8dfce114 2275
657ee2d8 2276 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
8dfce114
LP		 2277 if (!dn)
2278 return log_oom();
2279
2280 r = userns_mkdir(dest, dn, 0755, 0, 0);
2281 if (r < 0)
2282 return log_error_errno(r, "Failed to create '%s': %m", dn);
2283
2284 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2285 return log_oom();
2286
c6134d3e 2287 prefixed = path_join(dest, sl);
8dfce114
LP		 2288 if (!prefixed)
2289 return log_oom();
2290
2d9b74ba 2291 t = path_join("..", d);
8dfce114
LP		 2292 if (!t)
2293 return log_oom();
2294
2295 if (symlink(t, prefixed) < 0)
2296 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
88213476 2297 }
88213476
LP		 2298 }
2299
e58a1277
LP		 2300 return r;
2301}
88213476 2302
de40a303 2303static int make_extra_nodes(const char *dest) {
de40a303
LP		 2304 size_t i;
2305 int r;
2306
52f05ef2 2307 BLOCK_WITH_UMASK(0000);
de40a303
LP		 2308
2309 for (i = 0; i < arg_n_extra_nodes; i++) {
2310 _cleanup_free_ char *path = NULL;
2311 DeviceNode *n = arg_extra_nodes + i;
2312
c6134d3e 2313 path = path_join(dest, n->path);
de40a303
LP		 2314 if (!path)
2315 return log_oom();
2316
2317 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2318 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2319
2320 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2321 if (r < 0)
2322 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2323 }
2324
2325 return 0;
2326}
2327
03cfe0d5
LP		 2328static int setup_pts(const char *dest) {
2329 _cleanup_free_ char *options = NULL;
2330 const char *p;
709f6e46 2331 int r;
03cfe0d5 2332
349cc4a5 2333#if HAVE_SELINUX
03cfe0d5
LP		 2334 if (arg_selinux_apifs_context)
2335 (void) asprintf(&options,
3dce8915 2336 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 2337 arg_uid_shift + TTY_GID,
2338 arg_selinux_apifs_context);
2339 else
2340#endif
2341 (void) asprintf(&options,
3dce8915 2342 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 2343 arg_uid_shift + TTY_GID);
f2d88580 2344
03cfe0d5 2345 if (!options)
f2d88580
LP		 2346 return log_oom();
2347
03cfe0d5 2348 /* Mount /dev/pts itself */
cc9fce65 2349 p = prefix_roota(dest, "/dev/pts");
3f692e2e 2350 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e
ZJS		 2351 if (r < 0)
2352 return log_error_errno(r, "Failed to create /dev/pts: %m");
2353
511a8cfe 2354 r = mount_nofollow_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
60e76d48
ZJS		 2355 if (r < 0)
2356 return r;
709f6e46
MS		 2357 r = userns_lchown(p, 0, 0);
2358 if (r < 0)
2359 return log_error_errno(r, "Failed to chown /dev/pts: %m");
03cfe0d5
LP		 2360
2361 /* Create /dev/ptmx symlink */
2362 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 2363 if (symlink("pts/ptmx", p) < 0)
2364 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
709f6e46
MS		 2365 r = userns_lchown(p, 0, 0);
2366 if (r < 0)
2367 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
f2d88580 2368
03cfe0d5
LP		 2369 /* And fix /dev/pts/ptmx ownership */
2370 p = prefix_roota(dest, "/dev/pts/ptmx");
709f6e46
MS		 2371 r = userns_lchown(p, 0, 0);
2372 if (r < 0)
2373 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 2374
f2d88580
LP		 2375 return 0;
2376}
2377
3acc84eb 2378static int setup_stdio_as_dev_console(void) {
2fef50cd 2379 _cleanup_close_ int terminal = -1;
e58a1277 2380 int r;
e58a1277 2381
335d2ead
LP		 2382 /* We open the TTY in O_NOCTTY mode, so that we do not become controller yet. We'll do that later
2383 * explicitly, if we are configured to. */
2384 terminal = open_terminal("/dev/console", O_RDWR|O_NOCTTY);
3acc84eb
FB		 2385 if (terminal < 0)
2386 return log_error_errno(terminal, "Failed to open console: %m");
e58a1277 2387
3acc84eb
FB		 2388 /* Make sure we can continue logging to the original stderr, even if
2389 * stderr points elsewhere now */
2390 r = log_dup_console();
2391 if (r < 0)
2392 return log_error_errno(r, "Failed to duplicate stderr: %m");
de40a303 2393
3acc84eb
FB		 2394 /* invalidates 'terminal' on success and failure */
2395 r = rearrange_stdio(terminal, terminal, terminal);
2fef50cd 2396 TAKE_FD(terminal);
f647962d 2397 if (r < 0)
3acc84eb
FB		 2398 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2399
2400 return 0;
2401}
88213476 2402
3acc84eb
FB		 2403static int setup_dev_console(const char *console) {
2404 _cleanup_free_ char *p = NULL;
2405 int r;
a258bf26 2406
3acc84eb
FB		 2407 /* Create /dev/console symlink */
2408 r = path_make_relative("/dev", console, &p);
81f5049b 2409 if (r < 0)
3acc84eb
FB		 2410 return log_error_errno(r, "Failed to create relative path: %m");
2411
2412 if (symlink(p, "/dev/console") < 0)
2413 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
a258bf26 2414
3acc84eb 2415 return 0;
e58a1277
LP		 2416}
2417
8e5430c4
LP		 2418static int setup_keyring(void) {
2419 key_serial_t keyring;
2420
6b000af4
LP		 2421 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2422 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2423 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2424 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2425 * into the container. */
8e5430c4
LP		 2426
2427 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2428 if (keyring == -1) {
2429 if (errno == ENOSYS)
2430 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
065b4774 2431 else if (ERRNO_IS_PRIVILEGE(errno))
8e5430c4
LP		 2432 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2433 else
2434 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2435 }
2436
2437 return 0;
2438}
2439
3652872a
LP		 2440static int setup_credentials(const char *root) {
2441 const char *q;
2442 int r;
2443
2444 if (arg_n_credentials <= 0)
2445 return 0;
2446
2447 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2448 if (r < 0)
2449 return log_error_errno(r, "Failed to create /run/host: %m");
2450
2451 r = userns_mkdir(root, "/run/host/credentials", 0700, 0, 0);
2452 if (r < 0)
2453 return log_error_errno(r, "Failed to create /run/host/credentials: %m");
2454
2455 q = prefix_roota(root, "/run/host/credentials");
511a8cfe 2456 r = mount_nofollow_verbose(LOG_ERR, NULL, q, "ramfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0700");
3652872a
LP		 2457 if (r < 0)
2458 return r;
2459
2460 for (size_t i = 0; i < arg_n_credentials; i++) {
2461 _cleanup_free_ char *j = NULL;
2462 _cleanup_close_ int fd = -1;
2463
2464 j = path_join(q, arg_credentials[i].id);
2465 if (!j)
2466 return log_oom();
2467
2468 fd = open(j, O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC|O_NOFOLLOW, 0600);
2469 if (fd < 0)
2470 return log_error_errno(errno, "Failed to create credential file %s: %m", j);
2471
2472 r = loop_write(fd, arg_credentials[i].data, arg_credentials[i].size, /* do_poll= */ false);
2473 if (r < 0)
2474 return log_error_errno(r, "Failed to write credential to file %s: %m", j);
2475
2476 if (fchmod(fd, 0400) < 0)
2477 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", j);
2478
2479 if (arg_userns_mode != USER_NAMESPACE_NO) {
2480 if (fchown(fd, arg_uid_shift, arg_uid_shift) < 0)
2481 return log_error_errno(errno, "Failed to adjust ownership of %s: %m", j);
2482 }
2483 }
2484
2485 if (chmod(q, 0500) < 0)
2486 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", q);
2487
2488 r = userns_lchown(q, 0, 0);
2489 if (r < 0)
2490 return r;
2491
2492 /* Make both mount and superblock read-only now */
511a8cfe 2493 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
3652872a
LP		 2494 if (r < 0)
2495 return r;
2496
511a8cfe 2497 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0500");
3652872a
LP		 2498}
2499
5d9d3fcb 2500static int setup_kmsg(int fd_inner_socket) {
9ec5a93c
LP		 2501 _cleanup_(unlink_and_freep) char *from = NULL;
2502 _cleanup_free_ char *fifo = NULL;
2503 _cleanup_close_ int fd = -1;
9ec5a93c 2504 int r;
e58a1277 2505
5d9d3fcb 2506 assert(fd_inner_socket >= 0);
a258bf26 2507
52f05ef2 2508 BLOCK_WITH_UMASK(0000);
a258bf26 2509
1eacc470 2510 /* We create the kmsg FIFO as as temporary file in /run, but immediately delete it after bind mounting it to
9ec5a93c
LP		 2511 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2512 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2513 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2514
1eacc470 2515 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
9ec5a93c
LP		 2516 if (r < 0)
2517 return log_error_errno(r, "Failed to generate kmsg path: %m");
e58a1277 2518
9ec5a93c 2519 if (mkfifo(fifo, 0600) < 0)
03cfe0d5 2520 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
9ec5a93c
LP		 2521
2522 from = TAKE_PTR(fifo);
9ec5a93c 2523
511a8cfe 2524 r = mount_nofollow_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
60e76d48
ZJS		 2525 if (r < 0)
2526 return r;
e58a1277 2527
669fc4e5 2528 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
4a62c710
MS		 2529 if (fd < 0)
2530 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 2531
9ec5a93c 2532 /* Store away the fd in the socket, so that it stays open as long as we run the child */
5d9d3fcb 2533 r = send_one_fd(fd_inner_socket, fd, 0);
d9603714
DH		 2534 if (r < 0)
2535 return log_error_errno(r, "Failed to send FIFO fd: %m");
a258bf26 2536
25ea79fe 2537 return 0;
88213476
LP		 2538}
2539
761cf19d 2540struct ExposeArgs {
deff68e7
FW		 2541 union in_addr_union address4;
2542 union in_addr_union address6;
761cf19d
FW		 2543 struct FirewallContext *fw_ctx;
2544};
2545
1c4baffc 2546static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
99534007 2547 struct ExposeArgs *args = ASSERT_PTR(userdata);
6d0b55c2
LP		 2548
2549 assert(rtnl);
2550 assert(m);
6d0b55c2 2551
fb9044cb
LP		 2552 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
2553 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
6d0b55c2
LP		 2554 return 0;
2555}
2556
3a74cea5 2557static int setup_hostname(void) {
c818eef1 2558 int r;
3a74cea5 2559
0c582db0 2560 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
eb91eb18
LP		 2561 return 0;
2562
c818eef1
LP		 2563 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2564 if (r < 0)
2565 return log_error_errno(r, "Failed to set hostname: %m");
3a74cea5 2566
7027ff61 2567 return 0;
3a74cea5
LP		 2568}
2569
57fb9fb5 2570static int setup_journal(const char *directory) {
0f5e1382 2571 _cleanup_free_ char *d = NULL;
5980d463 2572 const char *p, *q;
b2238e38 2573 sd_id128_t this_id;
8054d749 2574 bool try;
57fb9fb5
LP		 2575 int r;
2576
df9a75e4
LP		 2577 /* Don't link journals in ephemeral mode */
2578 if (arg_ephemeral)
2579 return 0;
2580
8054d749
LP		 2581 if (arg_link_journal == LINK_NO)
2582 return 0;
2583
2584 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2585
4d680aee 2586 r = sd_id128_get_machine(&this_id);
f647962d
MS		 2587 if (r < 0)
2588 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee 2589
e01ff70a 2590 if (sd_id128_equal(arg_uuid, this_id)) {
8054d749 2591 log_full(try ? LOG_WARNING : LOG_ERR,
85b55869 2592 "Host and machine ids are equal (%s): refusing to link journals", SD_ID128_TO_STRING(arg_uuid));
8054d749 2593 if (try)
4d680aee 2594 return 0;
df9a75e4 2595 return -EEXIST;
4d680aee
ZJS		 2596 }
2597
369ca6da
ZJS		 2598 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2599 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2600 if (r < 0) {
2601 bool ignore = r == -EROFS && try;
2602 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2603 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2604 return ignore ? 0 : r;
2605 }
2606 }
03cfe0d5 2607
85b55869 2608 p = strjoina("/var/log/journal/", SD_ID128_TO_STRING(arg_uuid));
03cfe0d5 2609 q = prefix_roota(directory, p);
27407a01 2610
e1873695 2611 if (path_is_mount_point(p, NULL, 0) > 0) {
8054d749
LP		 2612 if (try)
2613 return 0;
27407a01 2614
baaa35ad
ZJS		 2615 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2616 "%s: already a mount point, refusing to use for journal", p);
57fb9fb5
LP		 2617 }
2618
e1873695 2619 if (path_is_mount_point(q, NULL, 0) > 0) {
8054d749
LP		 2620 if (try)
2621 return 0;
57fb9fb5 2622
baaa35ad
ZJS		 2623 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2624 "%s: already a mount point, refusing to use for journal", q);
57fb9fb5
LP		 2625 }
2626
2627 r = readlink_and_make_absolute(p, &d);
2628 if (r >= 0) {
3742095b 2629 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
57fb9fb5
LP		 2630 path_equal(d, q)) {
2631
03cfe0d5 2632 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2633 if (r < 0)
709f6e46 2634 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2635 return 0;
57fb9fb5
LP		 2636 }
2637
4a62c710
MS		 2638 if (unlink(p) < 0)
2639 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 2640 } else if (r == -EINVAL) {
2641
2642 if (arg_link_journal == LINK_GUEST &&
2643 rmdir(p) < 0) {
2644
27407a01
ZJS		 2645 if (errno == ENOTDIR) {
2646 log_error("%s already exists and is neither a symlink nor a directory", p);
2647 return r;
4314d33f
MS		 2648 } else
2649 return log_error_errno(errno, "Failed to remove %s: %m", p);
57fb9fb5 2650 }
4314d33f
MS		 2651 } else if (r != -ENOENT)
2652 return log_error_errno(r, "readlink(%s) failed: %m", p);
57fb9fb5
LP		 2653
2654 if (arg_link_journal == LINK_GUEST) {
2655
2656 if (symlink(q, p) < 0) {
8054d749 2657 if (try) {
56f64d95 2658 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90 2659 return 0;
4314d33f
MS		 2660 } else
2661 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
57fb9fb5
LP		 2662 }
2663
03cfe0d5 2664 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2665 if (r < 0)
709f6e46 2666 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2667 return 0;
57fb9fb5
LP		 2668 }
2669
2670 if (arg_link_journal == LINK_HOST) {
ccddd104 2671 /* don't create parents here — if the host doesn't have
574edc90 2672 * permanent journal set up, don't force it here */
ba8e6c4d 2673
3f692e2e 2674 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e 2675 if (r < 0 && r != -EEXIST) {
8054d749 2676 if (try) {
dae8b82e 2677 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
574edc90 2678 return 0;
4314d33f 2679 } else
dae8b82e 2680 return log_error_errno(r, "Failed to create %s: %m", p);
57fb9fb5
LP		 2681 }
2682
27407a01
ZJS		 2683 } else if (access(p, F_OK) < 0)
2684 return 0;
57fb9fb5 2685
db55bbf2 2686 if (dir_is_empty(q, /* ignore_hidden_or_backup= */ false) == 0)
cdb2b9d0
LP		 2687 log_warning("%s is not empty, proceeding anyway.", q);
2688
03cfe0d5 2689 r = userns_mkdir(directory, p, 0755, 0, 0);
709f6e46
MS		 2690 if (r < 0)
2691 return log_error_errno(r, "Failed to create %s: %m", q);
57fb9fb5 2692
511a8cfe 2693 r = mount_nofollow_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
60e76d48 2694 if (r < 0)
4a62c710 2695 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 2696
27407a01 2697 return 0;
57fb9fb5
LP		 2698}
2699
de40a303
LP		 2700static int drop_capabilities(uid_t uid) {
2701 CapabilityQuintet q;
2702
2703 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2704 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2705 * arg_caps_retain. */
2706
2707 if (capability_quintet_is_set(&arg_full_capabilities)) {
2708 q = arg_full_capabilities;
2709
f5fbe71d 2710 if (q.bounding == UINT64_MAX)
de40a303
LP		 2711 q.bounding = uid == 0 ? arg_caps_retain : 0;
2712
f5fbe71d 2713 if (q.effective == UINT64_MAX)
de40a303
LP		 2714 q.effective = uid == 0 ? q.bounding : 0;
2715
f5fbe71d 2716 if (q.inheritable == UINT64_MAX)
88fc9c9b 2717 q.inheritable = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2718
f5fbe71d 2719 if (q.permitted == UINT64_MAX)
88fc9c9b 2720 q.permitted = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2721
f5fbe71d 2722 if (q.ambient == UINT64_MAX && ambient_capabilities_supported())
88fc9c9b 2723 q.ambient = arg_caps_ambient;
f66ad460
AZ		 2724
2725 if (capability_quintet_mangle(&q))
2726 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2727
2728 } else {
de40a303
LP		 2729 q = (CapabilityQuintet) {
2730 .bounding = arg_caps_retain,
2731 .effective = uid == 0 ? arg_caps_retain : 0,
88fc9c9b
TH		 2732 .inheritable = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2733 .permitted = uid == 0 ? arg_caps_retain : arg_caps_ambient,
f5fbe71d 2734 .ambient = ambient_capabilities_supported() ? arg_caps_ambient : UINT64_MAX,
de40a303
LP		 2735 };
2736
f66ad460
AZ		 2737 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2738 * in order to maintain the same behavior as systemd < 242. */
2739 if (capability_quintet_mangle(&q))
0ccdaa79
JT		 2740 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2741 "Some capabilities will not be set because they are not in the current bounding set.");
f66ad460
AZ		 2742
2743 }
2744
de40a303 2745 return capability_quintet_enforce(&q);
88213476
LP		 2746}
2747
db999e0f
LP		 2748static int reset_audit_loginuid(void) {
2749 _cleanup_free_ char *p = NULL;
2750 int r;
2751
0c582db0 2752 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
db999e0f
LP		 2753 return 0;
2754
2755 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 2756 if (r == -ENOENT)
db999e0f 2757 return 0;
f647962d
MS		 2758 if (r < 0)
2759 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 2760
2761 /* Already reset? */
2762 if (streq(p, "4294967295"))
2763 return 0;
2764
57512c89 2765 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
db999e0f 2766 if (r < 0) {
10a87006
LP		 2767 log_error_errno(r,
2768 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2769 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2770 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2771 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2772 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 2773
db999e0f 2774 sleep(5);
77b6e194 2775 }
db999e0f
LP		 2776
2777 return 0;
77b6e194
LP		 2778}
2779
e79581dd 2780static int mount_tunnel_dig(const char *root) {
785890ac 2781 const char *p, *q;
709f6e46 2782 int r;
785890ac
LP		 2783
2784 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2785 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 2786 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 2787 (void) mkdir_p(p, 0600);
2788
5a27b395 2789 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
709f6e46 2790 if (r < 0)
5a27b395 2791 return log_error_errno(r, "Failed to create /run/host: %m");
03cfe0d5 2792
e79581dd 2793 r = userns_mkdir(root, NSPAWN_MOUNT_TUNNEL, 0600, 0, 0);
709f6e46 2794 if (r < 0)
e79581dd 2795 return log_error_errno(r, "Failed to create "NSPAWN_MOUNT_TUNNEL": %m");
03cfe0d5 2796
e79581dd 2797 q = prefix_roota(root, NSPAWN_MOUNT_TUNNEL);
511a8cfe 2798 r = mount_nofollow_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2799 if (r < 0)
2800 return r;
785890ac 2801
511a8cfe 2802 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
60e76d48
ZJS		 2803 if (r < 0)
2804 return r;
785890ac 2805
e79581dd
CB		 2806 return 0;
2807}
2808
2809static int mount_tunnel_open(void) {
2810 int r;
2811
2812 r = mount_follow_verbose(LOG_ERR, NULL, NSPAWN_MOUNT_TUNNEL, NULL, MS_SLAVE, NULL);
2813 if (r < 0)
2814 return r;
2815
2816 return 0;
785890ac
LP		 2817}
2818
317feb4d 2819static int setup_machine_id(const char *directory) {
691675ba
LP		 2820 const char *etc_machine_id;
2821 sd_id128_t id;
3bbaff3e 2822 int r;
e01ff70a 2823
317feb4d
LP		 2824 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2825 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2826 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2827 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2828 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2829 * container behaves nicely). */
2830
e01ff70a
MS		 2831 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2832
057bf780 2833 r = id128_read(etc_machine_id, ID128_FORMAT_PLAIN, &id);
317feb4d 2834 if (r < 0) {
057bf780 2835 if (!IN_SET(r, -ENOENT, -ENOMEDIUM, -ENOPKG)) /* If the file is missing, empty, or uninitialized, we don't mind */
317feb4d 2836 return log_error_errno(r, "Failed to read machine ID from container image: %m");
691675ba 2837
317feb4d
LP		 2838 if (sd_id128_is_null(arg_uuid)) {
2839 r = sd_id128_randomize(&arg_uuid);
2840 if (r < 0)
2841 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2842 }
2843 } else {
baaa35ad
ZJS		 2844 if (sd_id128_is_null(id))
2845 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2846 "Machine ID in container image is zero, refusing.");
e01ff70a 2847
317feb4d
LP		 2848 arg_uuid = id;
2849 }
691675ba 2850
e01ff70a
MS		 2851 return 0;
2852}
2853
7336138e
LP		 2854static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2855 int r;
2856
2857 assert(directory);
2858
6c045a99 2859 if (arg_userns_mode == USER_NAMESPACE_NO || arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_CHOWN)
7336138e
LP		 2860 return 0;
2861
2862 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2863 if (r == -EOPNOTSUPP)
2864 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2865 if (r == -EBADE)
2866 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2867 if (r < 0)
2868 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2869 if (r == 0)
2870 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2871 else
2872 log_debug("Patched directory tree to match UID/GID range.");
2873
2874 return r;
2875}
2876
113cea80 2877/*
6d416b9c
LS		 2878 * Return values:
2879 * < 0 : wait_for_terminate() failed to get the state of the
2880 * container, the container was terminated by a signal, or
2881 * failed for an unknown reason. No change is made to the
2882 * container argument.
2883 * > 0 : The program executed in the container terminated with an
2884 * error. The exit code of the program executed in the
919699ec
LP		 2885 * container is returned. The container argument has been set
2886 * to CONTAINER_TERMINATED.
6d416b9c
LS		 2887 * 0 : The container is being rebooted, has been shut down or exited
2888 * successfully. The container argument has been set to either
2889 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 2890 *
6d416b9c
LS		 2891 * That is, success is indicated by a return value of zero, and an
2892 * error is indicated by a non-zero value.
113cea80
DH		 2893 */
2894static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 2895 siginfo_t status;
919699ec 2896 int r;
113cea80
DH		 2897
2898 r = wait_for_terminate(pid, &status);
f647962d
MS		 2899 if (r < 0)
2900 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 2901
2902 switch (status.si_code) {
fddbb89c 2903
113cea80 2904 case CLD_EXITED:
b5a2179b 2905 if (status.si_status == 0)
919699ec 2906 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
b5a2179b 2907 else
919699ec 2908 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 2909
919699ec
LP		 2910 *container = CONTAINER_TERMINATED;
2911 return status.si_status;
113cea80
DH		 2912
2913 case CLD_KILLED:
2914 if (status.si_status == SIGINT) {
919699ec 2915 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 2916 *container = CONTAINER_TERMINATED;
919699ec
LP		 2917 return 0;
2918
113cea80 2919 } else if (status.si_status == SIGHUP) {
919699ec 2920 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 2921 *container = CONTAINER_REBOOTED;
919699ec 2922 return 0;
113cea80 2923 }
919699ec 2924
4831981d 2925 _fallthrough_;
113cea80 2926 case CLD_DUMPED:
baaa35ad
ZJS		 2927 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2928 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
113cea80
DH		 2929
2930 default:
baaa35ad
ZJS		 2931 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2932 "Container %s failed due to unknown reason.", arg_machine);
113cea80 2933 }
113cea80
DH		 2934}
2935
023fb90b
LP		 2936static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2937 pid_t pid;
2938
4a0b58c4 2939 pid = PTR_TO_PID(userdata);
023fb90b 2940 if (pid > 0) {
c6c8f6e2 2941 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 2942 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2943 sd_event_source_set_userdata(s, NULL);
2944 return 0;
2945 }
2946 }
2947
2948 sd_event_exit(sd_event_source_get_event(s), 0);
2949 return 0;
2950}
2951
6916b164 2952static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
abdb9b08
LP		 2953 pid_t pid;
2954
2955 assert(s);
2956 assert(ssi);
2957
2958 pid = PTR_TO_PID(userdata);
2959
6916b164
AU		 2960 for (;;) {
2961 siginfo_t si = {};
abdb9b08 2962
6916b164
AU		 2963 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2964 return log_error_errno(errno, "Failed to waitid(): %m");
2965 if (si.si_pid == 0) /* No pending children. */
2966 break;
abdb9b08 2967 if (si.si_pid == pid) {
6916b164
AU		 2968 /* The main process we care for has exited. Return from
2969 * signal handler but leave the zombie. */
2970 sd_event_exit(sd_event_source_get_event(s), 0);
2971 break;
2972 }
abdb9b08 2973
6916b164
AU		 2974 /* Reap all other children. */
2975 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2976 }
2977
2978 return 0;
2979}
2980
abdb9b08
LP		 2981static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2982 pid_t pid;
2983
2984 assert(m);
2985
2986 pid = PTR_TO_PID(userdata);
2987
2988 if (arg_kill_signal > 0) {
2989 log_info("Container termination requested. Attempting to halt container.");
2990 (void) kill(pid, arg_kill_signal);
2991 } else {
2992 log_info("Container termination requested. Exiting.");
2993 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
2994 }
2995
2996 return 0;
2997}
2998
ec16945e 2999static int determine_names(void) {
1b9cebf6 3000 int r;
ec16945e 3001
c1521918
LP		 3002 if (arg_template && !arg_directory && arg_machine) {
3003
3004 /* If --template= was specified then we should not
3005 * search for a machine, but instead create a new one
3006 * in /var/lib/machine. */
3007
657ee2d8 3008 arg_directory = path_join("/var/lib/machines", arg_machine);
c1521918
LP		 3009 if (!arg_directory)
3010 return log_oom();
3011 }
3012
ec16945e 3013 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 3014 if (arg_machine) {
3015 _cleanup_(image_unrefp) Image *i = NULL;
3016
d577d4a4 3017 r = image_find(IMAGE_MACHINE, arg_machine, NULL, &i);
3a6ce860
LP		 3018 if (r == -ENOENT)
3019 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
1b9cebf6
LP		 3020 if (r < 0)
3021 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
1b9cebf6 3022
eb38edce 3023 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
0f03c2a4 3024 r = free_and_strdup(&arg_image, i->path);
1b9cebf6 3025 else
0f03c2a4 3026 r = free_and_strdup(&arg_directory, i->path);
1b9cebf6 3027 if (r < 0)
0f3be6ca 3028 return log_oom();
1b9cebf6 3029
aee327b8
LP		 3030 if (!arg_ephemeral)
3031 arg_read_only = arg_read_only || i->read_only;
d7249575
LP		 3032 } else {
3033 r = safe_getcwd(&arg_directory);
3034 if (r < 0)
3035 return log_error_errno(r, "Failed to determine current directory: %m");
3036 }
ec16945e 3037
c6147113
LP		 3038 if (!arg_directory && !arg_image)
3039 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
ec16945e
LP		 3040 }
3041
3042 if (!arg_machine) {
b9ba4dab
LP		 3043 if (arg_directory && path_equal(arg_directory, "/"))
3044 arg_machine = gethostname_malloc();
e9b88a6d
LP		 3045 else if (arg_image) {
3046 char *e;
4827ab48 3047
e9b88a6d 3048 arg_machine = strdup(basename(arg_image));
4827ab48 3049
e9b88a6d
LP		 3050 /* Truncate suffix if there is one */
3051 e = endswith(arg_machine, ".raw");
3052 if (e)
3053 *e = 0;
3054 } else
3055 arg_machine = strdup(basename(arg_directory));
ec16945e
LP		 3056 if (!arg_machine)
3057 return log_oom();
3058
ae691c1d 3059 hostname_cleanup(arg_machine);
52ef5dd7 3060 if (!hostname_is_valid(arg_machine, 0))
c6147113 3061 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
b9ba4dab 3062
3603f151
LB		 3063 /* Copy the machine name before the random suffix is added below, otherwise we won't be able
3064 * to match fixed config file names. */
3065 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3066 if (!arg_settings_filename)
3067 return log_oom();
3068
e9b88a6d
LP		 3069 /* Add a random suffix when this is an ephemeral machine, so that we can run many
3070 * instances at once without manually having to specify -M each time. */
3071 if (arg_ephemeral)
3072 if (strextendf(&arg_machine, "-%016" PRIx64, random_u64()) < 0)
b9ba4dab 3073 return log_oom();
3603f151
LB		 3074 } else {
3075 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3076 if (!arg_settings_filename)
3077 return log_oom();
ec16945e
LP		 3078 }
3079
3080 return 0;
3081}
3082
8d4aa2bb 3083static int chase_symlinks_and_update(char **p, unsigned flags) {
3f342ec4
LP		 3084 char *chased;
3085 int r;
3086
3087 assert(p);
3088
3089 if (!*p)
3090 return 0;
3091
a5648b80 3092 r = chase_symlinks(*p, NULL, flags, &chased, NULL);
3f342ec4
LP		 3093 if (r < 0)
3094 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
3095
a5648b80 3096 return free_and_replace(*p, chased);
3f342ec4
LP		 3097}
3098
03cfe0d5 3099static int determine_uid_shift(const char *directory) {
6dac160c 3100
0de7acce 3101 if (arg_userns_mode == USER_NAMESPACE_NO) {
03cfe0d5 3102 arg_uid_shift = 0;
6dac160c 3103 return 0;
03cfe0d5 3104 }
6dac160c
LP		 3105
3106 if (arg_uid_shift == UID_INVALID) {
3107 struct stat st;
3108
993da6d4
LP		 3109 /* Read the UID shift off the image. Maybe we can reuse this to avoid chowning. */
3110
3111 if (stat(directory, &st) < 0)
03cfe0d5 3112 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 3113
3114 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
3115
baaa35ad
ZJS		 3116 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
3117 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3118 "UID and GID base of %s don't match.", directory);
6dac160c
LP		 3119
3120 arg_uid_range = UINT32_C(0x10000);
f61c7f88
LP		 3121
3122 if (arg_uid_shift != 0) {
3123 /* If the image is shifted already, then we'll fall back to classic chowning, for
3124 * compatibility (and simplicity), or refuse if mapping is explicitly requested. */
3125
3126 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_AUTO) {
3127 log_debug("UID base of %s is non-zero, not using UID mapping.", directory);
3128 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3129 } else if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_MAP)
3130 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3131 "UID base of %s is not zero, UID mapping not supported.", directory);
3132 }
6dac160c
LP		 3133 }
3134
58e13de5
LP		 3135 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
3136 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID base too high for UID range.");
6dac160c 3137
6dac160c
LP		 3138 return 0;
3139}
3140
de40a303
LP		 3141static unsigned long effective_clone_ns_flags(void) {
3142 unsigned long flags = arg_clone_ns_flags;
3143
3144 if (arg_private_network)
3145 flags |= CLONE_NEWNET;
3146 if (arg_use_cgns)
3147 flags |= CLONE_NEWCGROUP;
3148 if (arg_userns_mode != USER_NAMESPACE_NO)
3149 flags |= CLONE_NEWUSER;
3150
3151 return flags;
3152}
3153
3154static int patch_sysctl(void) {
3155
3156 /* This table is inspired by runc's sysctl() function */
3157 static const struct {
3158 const char *key;
3159 bool prefix;
3160 unsigned long clone_flags;
3161 } safe_sysctl[] = {
3162 { "kernel.hostname", false, CLONE_NEWUTS },
3163 { "kernel.domainname", false, CLONE_NEWUTS },
3164 { "kernel.msgmax", false, CLONE_NEWIPC },
3165 { "kernel.msgmnb", false, CLONE_NEWIPC },
3166 { "kernel.msgmni", false, CLONE_NEWIPC },
3167 { "kernel.sem", false, CLONE_NEWIPC },
3168 { "kernel.shmall", false, CLONE_NEWIPC },
3169 { "kernel.shmmax", false, CLONE_NEWIPC },
3170 { "kernel.shmmni", false, CLONE_NEWIPC },
3171 { "fs.mqueue.", true, CLONE_NEWIPC },
3172 { "net.", true, CLONE_NEWNET },
3173 };
3174
3175 unsigned long flags;
de40a303
LP		 3176 int r;
3177
3178 flags = effective_clone_ns_flags();
3179
3180 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
3181 bool good = false;
3182 size_t i;
3183
3184 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
3185
3186 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
3187 continue;
3188
3189 if (safe_sysctl[i].prefix)
3190 good = startswith(*k, safe_sysctl[i].key);
3191 else
3192 good = streq(*k, safe_sysctl[i].key);
3193
3194 if (good)
3195 break;
3196 }
3197
c6147113
LP		 3198 if (!good)
3199 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
de40a303
LP		 3200
3201 r = sysctl_write(*k, *v);
3202 if (r < 0)
3203 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
3204 }
3205
3206 return 0;
3207}
3208
03cfe0d5
LP		 3209static int inner_child(
3210 Barrier *barrier,
3211 const char *directory,
3212 bool secondary,
5d9d3fcb 3213 int fd_inner_socket,
e1bb4b0d
LB		 3214 FDSet *fds,
3215 char **os_release_pairs) {
69c79d3c 3216
03cfe0d5 3217 _cleanup_free_ char *home = NULL;
88614c8a 3218 size_t n_env = 1;
4ab3d29f
ZJS		 3219 char *envp[] = {
3220 (char*) "PATH=" DEFAULT_PATH_COMPAT,
6aadfa4c 3221 NULL, /* container */
03cfe0d5
LP		 3222 NULL, /* TERM */
3223 NULL, /* HOME */
3224 NULL, /* USER */
3225 NULL, /* LOGNAME */
3226 NULL, /* container_uuid */
3227 NULL, /* LISTEN_FDS */
3228 NULL, /* LISTEN_PID */
9c1e04d0 3229 NULL, /* NOTIFY_SOCKET */
3652872a 3230 NULL, /* CREDENTIALS_DIRECTORY */
b626f695 3231 NULL, /* LANG */
03cfe0d5
LP		 3232 NULL
3233 };
1a68e1e5 3234 const char *exec_target;
2371271c 3235 _cleanup_strv_free_ char **env_use = NULL;
de40a303 3236 int r, which_failed;
88213476 3237
b37469d7
LP		 3238 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
3239 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
3240 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
3241 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
3242 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
3243 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
3244 * namespace.
3245 *
3246 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
3247 * unshare(). See below. */
3248
03cfe0d5
LP		 3249 assert(barrier);
3250 assert(directory);
5d9d3fcb 3251 assert(fd_inner_socket >= 0);
88213476 3252
de40a303
LP		 3253 log_debug("Inner child is initializing.");
3254
0de7acce 3255 if (arg_userns_mode != USER_NAMESPACE_NO) {
03cfe0d5
LP		 3256 /* Tell the parent, that it now can write the UID map. */
3257 (void) barrier_place(barrier); /* #1 */
7027ff61 3258
03cfe0d5 3259 /* Wait until the parent wrote the UID map */
baaa35ad 3260 if (!barrier_place_and_sync(barrier)) /* #2 */
2a2e78e9 3261 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
88213476 3262
2a2e78e9
LP		 3263 /* Become the new root user inside our namespace */
3264 r = reset_uid_gid();
3265 if (r < 0)
3266 return log_error_errno(r, "Couldn't become new root: %m");
3267
3268 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
3269 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
3270 * propagation, but simply create new peer groups for all our mounts). */
511a8cfe 3271 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
2a2e78e9
LP		 3272 if (r < 0)
3273 return r;
3274 }
6d66bd3b 3275
0de7acce 3276 r = mount_all(NULL,
4f086aab 3277 arg_mount_settings | MOUNT_IN_USERNS,
0de7acce 3278 arg_uid_shift,
0de7acce 3279 arg_selinux_apifs_context);
03cfe0d5
LP		 3280 if (r < 0)
3281 return r;
3282
04413780
ZJS		 3283 if (!arg_network_namespace_path && arg_private_network) {
3284 r = unshare(CLONE_NEWNET);
3285 if (r < 0)
3286 return log_error_errno(errno, "Failed to unshare network namespace: %m");
75116558
PS		 3287
3288 /* Tell the parent that it can setup network interfaces. */
3289 (void) barrier_place(barrier); /* #3 */
04413780
ZJS		 3290 }
3291
4f086aab 3292 r = mount_sysfs(NULL, arg_mount_settings);
d8fc6a00
LP		 3293 if (r < 0)
3294 return r;
3295
03cfe0d5
LP		 3296 /* Wait until we are cgroup-ified, so that we
3297 * can mount the right cgroup path writable */
baaa35ad
ZJS		 3298 if (!barrier_place_and_sync(barrier)) /* #4 */
3299 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3300 "Parent died too early");
88213476 3301
489fae52 3302 if (arg_use_cgns) {
0996ef00
CB		 3303 r = unshare(CLONE_NEWCGROUP);
3304 if (r < 0)
04413780 3305 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
0996ef00
CB		 3306 r = mount_cgroups(
3307 "",
3308 arg_unified_cgroup_hierarchy,
3309 arg_userns_mode != USER_NAMESPACE_NO,
3310 arg_uid_shift,
3311 arg_uid_range,
5a8ff0e6 3312 arg_selinux_apifs_context,
ada54120 3313 true);
1433e0f2 3314 } else
0996ef00 3315 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
1433e0f2
LP		 3316 if (r < 0)
3317 return r;
ec16945e 3318
1e4f1671 3319 r = setup_boot_id();
03cfe0d5
LP		 3320 if (r < 0)
3321 return r;
ec16945e 3322
5d9d3fcb 3323 r = setup_kmsg(fd_inner_socket);
03cfe0d5
LP		 3324 if (r < 0)
3325 return r;
ec16945e 3326
de40a303
LP		 3327 r = mount_custom(
3328 "/",
3329 arg_custom_mounts,
3330 arg_n_custom_mounts,
de40a303 3331 0,
c0c8f718 3332 0,
de40a303 3333 arg_selinux_apifs_context,
5f0a6347 3334 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
de40a303
LP		 3335 if (r < 0)
3336 return r;
3337
03cfe0d5
LP		 3338 if (setsid() < 0)
3339 return log_error_errno(errno, "setsid() failed: %m");
3340
3341 if (arg_private_network)
df883de9 3342 (void) loopback_setup();
03cfe0d5 3343
7a8f6325 3344 if (arg_expose_ports) {
b07ee903 3345 r = expose_port_send_rtnl(fd_inner_socket);
7a8f6325
LP		 3346 if (r < 0)
3347 return r;
7a8f6325 3348 }
03cfe0d5 3349
3acc84eb 3350 if (arg_console_mode != CONSOLE_PIPE) {
cd132992 3351 _cleanup_close_ int master = -1;
3acc84eb
FB		 3352 _cleanup_free_ char *console = NULL;
3353
3354 /* Allocate a pty and make it available as /dev/console. */
dc98caea 3355 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3acc84eb 3356 if (master < 0)
dc98caea 3357 return log_error_errno(master, "Failed to allocate a pty: %m");
3acc84eb
FB		 3358
3359 r = setup_dev_console(console);
3360 if (r < 0)
105a1a36 3361 return log_error_errno(r, "Failed to set up /dev/console: %m");
3acc84eb 3362
bb1aa185 3363 r = send_one_fd(fd_inner_socket, master, 0);
3acc84eb
FB		 3364 if (r < 0)
3365 return log_error_errno(r, "Failed to send master fd: %m");
3acc84eb
FB		 3366
3367 r = setup_stdio_as_dev_console();
3368 if (r < 0)
3369 return r;
3370 }
3371
de40a303
LP		 3372 r = patch_sysctl();
3373 if (r < 0)
3374 return r;
3375
81f345df
LP		 3376 if (arg_oom_score_adjust_set) {
3377 r = set_oom_score_adjust(arg_oom_score_adjust);
3378 if (r < 0)
3379 return log_error_errno(r, "Failed to adjust OOM score: %m");
3380 }
3381
0985c7c4
ZJS		 3382 if (arg_cpu_set.set)
3383 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
d107bb7d
LP		 3384 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3385
c818eef1 3386 (void) setup_hostname();
03cfe0d5 3387
050f7277 3388 if (arg_personality != PERSONALITY_INVALID) {
21022b9d
LP		 3389 r = safe_personality(arg_personality);
3390 if (r < 0)
3391 return log_error_errno(r, "personality() failed: %m");
03cfe0d5 3392 } else if (secondary) {
21022b9d
LP		 3393 r = safe_personality(PER_LINUX32);
3394 if (r < 0)
3395 return log_error_errno(r, "personality() failed: %m");
03cfe0d5
LP		 3396 }
3397
de40a303
LP		 3398 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3399 if (r < 0)
3400 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3401
3402#if HAVE_SECCOMP
3403 if (arg_seccomp) {
3404
3405 if (is_seccomp_available()) {
3406
3407 r = seccomp_load(arg_seccomp);
7bc5e0b1 3408 if (ERRNO_IS_SECCOMP_FATAL(r))
de40a303
LP		 3409 return log_error_errno(r, "Failed to install seccomp filter: %m");
3410 if (r < 0)
3411 log_debug_errno(r, "Failed to install seccomp filter: %m");
3412 }
3413 } else
3414#endif
3415 {
6b000af4 3416 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
de40a303
LP		 3417 if (r < 0)
3418 return r;
3419 }
3420
4a4654e0 3421 if (arg_suppress_sync) {
20e458ae 3422#if HAVE_SECCOMP
4a4654e0
LP		 3423 r = seccomp_suppress_sync();
3424 if (r < 0)
3425 log_debug_errno(r, "Failed to install sync() suppression seccomp filter, ignoring: %m");
20e458ae 3426#else
2db32618 3427 log_debug("systemd is built without SECCOMP support. Ignoring --suppress-sync= command line option and SuppressSync= setting.");
20e458ae 3428#endif
4a4654e0
LP		 3429 }
3430
349cc4a5 3431#if HAVE_SELINUX
03cfe0d5 3432 if (arg_selinux_context)
2ed96880 3433 if (setexeccon(arg_selinux_context) < 0)
03cfe0d5
LP		 3434 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3435#endif
3436
de40a303
LP		 3437 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3438 * if we need to later on. */
3439 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3440 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3441
3442 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3462d773 3443 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids, arg_console_mode != CONSOLE_PIPE);
de40a303 3444 else
3462d773 3445 r = change_uid_gid(arg_user, arg_console_mode != CONSOLE_PIPE, &home);
03cfe0d5
LP		 3446 if (r < 0)
3447 return r;
3448
de40a303
LP		 3449 r = drop_capabilities(getuid());
3450 if (r < 0)
3451 return log_error_errno(r, "Dropping capabilities failed: %m");
3452
66edd963
LP		 3453 if (arg_no_new_privileges)
3454 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3455 return log_error_errno(errno, "Failed to disable new privileges: %m");
3456
6aadfa4c
ILG		 3457 /* LXC sets container=lxc, so follow the scheme here */
3458 envp[n_env++] = strjoina("container=", arg_container_service_name);
3459
03cfe0d5
LP		 3460 envp[n_env] = strv_find_prefix(environ, "TERM=");
3461 if (envp[n_env])
313cefa1 3462 n_env++;
03cfe0d5 3463
de40a303 3464 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f 3465 if (asprintf(envp + n_env++, "HOME=%s", home ?: "/root") < 0)
de40a303
LP		 3466 return log_oom();
3467
3468 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f
ZJS		 3469 if (asprintf(envp + n_env++, "USER=%s", arg_user ?: "root") < 0 ||
3470 asprintf(envp + n_env++, "LOGNAME=%s", arg_user ? arg_user : "root") < 0)
de40a303 3471 return log_oom();
03cfe0d5 3472
3bbaff3e 3473 assert(!sd_id128_is_null(arg_uuid));
03cfe0d5 3474
b7416360 3475 if (asprintf(envp + n_env++, "container_uuid=%s", SD_ID128_TO_UUID_STRING(arg_uuid)) < 0)
e01ff70a 3476 return log_oom();
03cfe0d5
LP		 3477
3478 if (fdset_size(fds) > 0) {
3479 r = fdset_cloexec(fds, false);
3480 if (r < 0)
3481 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3482
4ab3d29f
ZJS		 3483 if ((asprintf(envp + n_env++, "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3484 (asprintf(envp + n_env++, "LISTEN_PID=1") < 0))
03cfe0d5
LP		 3485 return log_oom();
3486 }
4ab3d29f 3487 if (asprintf(envp + n_env++, "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
9c1e04d0 3488 return log_oom();
03cfe0d5 3489
3652872a
LP		 3490 if (arg_n_credentials > 0) {
3491 envp[n_env] = strdup("CREDENTIALS_DIRECTORY=/run/host/credentials");
3492 if (!envp[n_env])
3493 return log_oom();
3494 n_env++;
3495 }
3496
b626f695 3497 if (arg_start_mode != START_BOOT) {
a22f5186 3498 envp[n_env] = strdup("LANG=" SYSTEMD_NSPAWN_LOCALE);
b626f695
DDM		 3499 if (!envp[n_env])
3500 return log_oom();
3501 n_env++;
3502 }
3503
4ab3d29f 3504 env_use = strv_env_merge(envp, os_release_pairs, arg_setenv);
2371271c
TG		 3505 if (!env_use)
3506 return log_oom();
03cfe0d5
LP		 3507
3508 /* Let the parent know that we are ready and
3509 * wait until the parent is ready with the
3510 * setup, too... */
baaa35ad 3511 if (!barrier_place_and_sync(barrier)) /* #5 */
335d2ead 3512 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
03cfe0d5 3513
5f932eb9
LP		 3514 if (arg_chdir)
3515 if (chdir(arg_chdir) < 0)
3516 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3517
7732f92b 3518 if (arg_start_mode == START_PID2) {
75bf701f 3519 r = stub_pid1(arg_uuid);
7732f92b
LP		 3520 if (r < 0)
3521 return r;
3522 }
3523
335d2ead
LP		 3524 if (arg_console_mode != CONSOLE_PIPE) {
3525 /* So far our pty wasn't controlled by any process. Finally, it's time to change that, if we
3526 * are configured for that. Acquire it as controlling tty. */
3527 if (ioctl(STDIN_FILENO, TIOCSCTTY) < 0)
3528 return log_error_errno(errno, "Failed to acquire controlling TTY: %m");
3529 }
3530
de40a303
LP		 3531 log_debug("Inner child completed, invoking payload.");
3532
8ca082b4
LP		 3533 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3534 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3535 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
03cfe0d5 3536 log_close();
8ca082b4
LP		 3537 log_set_open_when_needed(true);
3538
03cfe0d5
LP		 3539 (void) fdset_close_others(fds);
3540
7732f92b 3541 if (arg_start_mode == START_BOOT) {
03cfe0d5
LP		 3542 char **a;
3543 size_t m;
3544
3545 /* Automatically search for the init system */
3546
75f32f04
ZJS		 3547 m = strv_length(arg_parameters);
3548 a = newa(char*, m + 2);
3549 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3550 a[1 + m] = NULL;
03cfe0d5 3551
a5096641
LP		 3552 FOREACH_STRING(init,
3553 "/usr/lib/systemd/systemd",
3554 "/lib/systemd/systemd",
3555 "/sbin/init") {
3556 a[0] = (char*) init;
3557 execve(a[0], a, env_use);
3558 }
ced58da7
LP		 3559
3560 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
1a68e1e5 3561 } else if (!strv_isempty(arg_parameters)) {
b6b180b7
LP		 3562 const char *dollar_path;
3563
1a68e1e5 3564 exec_target = arg_parameters[0];
b6b180b7
LP		 3565
3566 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3567 * binary. */
3568 dollar_path = strv_env_get(env_use, "PATH");
3569 if (dollar_path) {
6f646e01 3570 if (setenv("PATH", dollar_path, 1) < 0)
b6b180b7
LP		 3571 return log_error_errno(errno, "Failed to update $PATH: %m");
3572 }
3573
f757855e 3574 execvpe(arg_parameters[0], arg_parameters, env_use);
1a68e1e5 3575 } else {
5f932eb9 3576 if (!arg_chdir)
d929b0f9
ZJS		 3577 /* If we cannot change the directory, we'll end up in /, that is expected. */
3578 (void) chdir(home ?: "/root");
5f932eb9 3579
53350c7b 3580 execle(DEFAULT_USER_SHELL, "-" DEFAULT_USER_SHELL_NAME, NULL, env_use);
3581 if (!streq(DEFAULT_USER_SHELL, "/bin/bash"))
3582 execle("/bin/bash", "-bash", NULL, env_use);
3583 if (!streq(DEFAULT_USER_SHELL, "/bin/sh"))
3584 execle("/bin/sh", "-sh", NULL, env_use);
ced58da7 3585
53350c7b 3586 exec_target = DEFAULT_USER_SHELL ", /bin/bash, /bin/sh";
03cfe0d5
LP		 3587 }
3588
8ca082b4 3589 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
03cfe0d5
LP		 3590}
3591
e96ceaba 3592static int setup_notify_child(void) {
271f518f 3593 _cleanup_close_ int fd = -1;
1eb874b9 3594 static const union sockaddr_union sa = {
44ed5214
LP		 3595 .un.sun_family = AF_UNIX,
3596 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
9c1e04d0
AP		 3597 };
3598 int r;
3599
3600 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3601 if (fd < 0)
3602 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3603
3604 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
fbda85b0 3605 (void) sockaddr_un_unlink(&sa.un);
9c1e04d0 3606
9c1e04d0 3607 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
271f518f 3608 if (r < 0)
44ed5214 3609 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
9c1e04d0 3610
adc7d9f0 3611 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
271f518f 3612 if (r < 0)
adc7d9f0 3613 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
adc7d9f0 3614
2ff48e98 3615 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
271f518f 3616 if (r < 0)
2ff48e98 3617 return log_error_errno(r, "SO_PASSCRED failed: %m");
9c1e04d0 3618
271f518f 3619 return TAKE_FD(fd);
9c1e04d0
AP		 3620}
3621
03cfe0d5
LP		 3622static int outer_child(
3623 Barrier *barrier,
3624 const char *directory,
2d845785 3625 DissectedImage *dissected_image,
03cfe0d5 3626 bool secondary,
af06cd30 3627 int fd_outer_socket,
5d9d3fcb 3628 int fd_inner_socket,
d7bea6b6
DP		 3629 FDSet *fds,
3630 int netns_fd) {
03cfe0d5 3631
2f893044 3632 _cleanup_(bind_user_context_freep) BindUserContext *bind_user_context = NULL;
e1bb4b0d 3633 _cleanup_strv_free_ char **os_release_pairs = NULL;
b71a0192 3634 _cleanup_close_ int fd = -1, mntns_fd = -EBADF;
f61c7f88 3635 bool idmap = false;
e5f10caf 3636 const char *p;
03cfe0d5
LP		 3637 pid_t pid;
3638 ssize_t l;
de40a303 3639 int r;
03cfe0d5 3640
d1d0b895
LP		 3641 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It
3642 * already has its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in
3643 * the host's CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET
3644 * namespaces. After it completed a number of initializations a second child (the "inner" one) is
3645 * forked off it, and it exits. */
b37469d7 3646
03cfe0d5
LP		 3647 assert(barrier);
3648 assert(directory);
af06cd30 3649 assert(fd_outer_socket >= 0);
5d9d3fcb 3650 assert(fd_inner_socket >= 0);
03cfe0d5 3651
de40a303
LP		 3652 log_debug("Outer child is initializing.");
3653
e1bb4b0d
LB		 3654 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3655 if (r < 0)
3656 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3657
03cfe0d5
LP		 3658 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3659 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3660
03cfe0d5
LP		 3661 r = reset_audit_loginuid();
3662 if (r < 0)
3663 return r;
3664
2a2e78e9
LP		 3665 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3666 * mounts to the real root. */
511a8cfe 3667 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
60e76d48
ZJS		 3668 if (r < 0)
3669 return r;
03cfe0d5 3670
2d845785 3671 if (dissected_image) {
d1d0b895
LP		 3672 /* If we are operating on a disk image, then mount its root directory now, but leave out the
3673 * rest. We can read the UID shift from it if we need to. Further down we'll mount the rest,
3674 * but then with the uid shift known. That way we can mount VFAT file systems shifted to the
3675 * right place right away. This makes sure ESP partitions and userns are compatible. */
2d3a5a73 3676
af187ab2 3677 r = dissected_image_mount_and_warn(
d04faa4e
LP		 3678 dissected_image,
3679 directory,
3680 arg_uid_shift,
21b61b1d 3681 arg_uid_range,
d04faa4e
LP		 3682 DISSECT_IMAGE_MOUNT_ROOT_ONLY|
3683 DISSECT_IMAGE_DISCARD_ON_LOOP|
3684 DISSECT_IMAGE_USR_NO_ROOT|
c65f854a 3685 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
af187ab2 3686 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
2d845785 3687 if (r < 0)
af187ab2 3688 return r;
2d845785 3689 }
03cfe0d5 3690
391567f4
LP		 3691 r = determine_uid_shift(directory);
3692 if (r < 0)
3693 return r;
3694
0de7acce 3695 if (arg_userns_mode != USER_NAMESPACE_NO) {
b71a0192
CB		 3696 r = namespace_open(0, NULL, &mntns_fd, NULL, NULL, NULL);
3697 if (r < 0)
3698 return log_error_errno(r, "Failed to pin outer mount namespace: %m");
3699
af06cd30 3700 l = send_one_fd(fd_outer_socket, mntns_fd, 0);
b71a0192
CB		 3701 if (l < 0)
3702 return log_error_errno(l, "Failed to send outer mount namespace fd: %m");
3703 mntns_fd = safe_close(mntns_fd);
3704
0e7ac751 3705 /* Let the parent know which UID shift we read from the image */
af06cd30 3706 l = send(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
825d5287
RM		 3707 if (l < 0)
3708 return log_error_errno(errno, "Failed to send UID shift: %m");
baaa35ad
ZJS		 3709 if (l != sizeof(arg_uid_shift))
3710 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3711 "Short write while sending UID shift.");
0e7ac751 3712
0de7acce 3713 if (arg_userns_mode == USER_NAMESPACE_PICK) {
d1d0b895
LP		 3714 /* When we are supposed to pick the UID shift, the parent will check now whether the
3715 * UID shift we just read from the image is available. If yes, it will send the UID
3716 * shift back to us, if not it will pick a different one, and send it back to us. */
0e7ac751 3717
af06cd30 3718 l = recv(fd_outer_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
0e7ac751
LP		 3719 if (l < 0)
3720 return log_error_errno(errno, "Failed to recv UID shift: %m");
baaa35ad
ZJS		 3721 if (l != sizeof(arg_uid_shift))
3722 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3723 "Short read while receiving UID shift.");
0e7ac751
LP		 3724 }
3725
ff6c6cc1
LP		 3726 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3727 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
825d5287
RM		 3728 }
3729
6f83d3d1
LP		 3730 if (path_equal(directory, "/")) {
3731 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3732 * place, so that we can make changes to its mount structure (for example, to implement
3733 * --volatile=) without this interfering with our ability to access files such as
3734 * /etc/localtime to copy into the container. Note that we use a fixed place for this
6c2d70ce 3735 * (instead of a temporary directory, since we are living in our own mount namespace here
7802194a 3736 * already, and thus don't need to be afraid of colliding with anyone else's mounts). */
6f83d3d1
LP		 3737 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3738
511a8cfe 3739 r = mount_nofollow_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
6f83d3d1
LP		 3740 if (r < 0)
3741 return r;
3742
3743 directory = "/run/systemd/nspawn-root";
e50cd82f 3744 }
7d0ecdd6
LP		 3745
3746 r = setup_pivot_root(
3747 directory,
3748 arg_pivot_root_new,
3749 arg_pivot_root_old);
3750 if (r < 0)
3751 return r;
3752
3753 r = setup_volatile_mode(
3754 directory,
3755 arg_volatile_mode,
7d0ecdd6 3756 arg_uid_shift,
8f1ed04a 3757 arg_selinux_apifs_context);
7d0ecdd6
LP		 3758 if (r < 0)
3759 return r;
3760
2f893044
LP		 3761 r = bind_user_prepare(
3762 directory,
3763 arg_bind_user,
3764 arg_uid_shift,
3765 arg_uid_range,
3766 &arg_custom_mounts, &arg_n_custom_mounts,
3767 &bind_user_context);
3768 if (r < 0)
3769 return r;
3770
3771 if (arg_userns_mode != USER_NAMESPACE_NO && bind_user_context) {
d1d0b895
LP		 3772 /* Send the user maps we determined to the parent, so that it installs it in our user
3773 * namespace UID map table */
2f893044
LP		 3774
3775 for (size_t i = 0; i < bind_user_context->n_data; i++) {
3776 uid_t map[] = {
3777 bind_user_context->data[i].payload_user->uid,
3778 bind_user_context->data[i].host_user->uid,
3779 (uid_t) bind_user_context->data[i].payload_group->gid,
3780 (uid_t) bind_user_context->data[i].host_group->gid,
3781 };
3782
af06cd30 3783 l = send(fd_outer_socket, map, sizeof(map), MSG_NOSIGNAL);
2f893044
LP		 3784 if (l < 0)
3785 return log_error_errno(errno, "Failed to send user UID map: %m");
3786 if (l != sizeof(map))
3787 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3788 "Short write while sending user UID map.");
3789 }
3790 }
3791
5f0a6347
DDM		 3792 r = mount_custom(
3793 directory,
3794 arg_custom_mounts,
3795 arg_n_custom_mounts,
5f0a6347 3796 arg_uid_shift,
c0c8f718 3797 arg_uid_range,
5f0a6347
DDM		 3798 arg_selinux_apifs_context,
3799 MOUNT_ROOT_ONLY);
3800 if (r < 0)
3801 return r;
3802
5530dc87 3803 /* Make sure we always have a mount that we can move to root later on. */
14a25e1f
LP		 3804 r = make_mount_point(directory);
3805 if (r < 0)
3806 return r;
5530dc87 3807
c0c8f718
AV		 3808 if (arg_userns_mode != USER_NAMESPACE_NO &&
3809 IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
3810 arg_uid_shift != 0) {
3811
2b2777ed 3812 r = remount_idmap(directory, arg_uid_shift, arg_uid_range, UID_INVALID, REMOUNT_IDMAPPING_HOST_ROOT);
c0c8f718
AV		 3813 if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) {
3814 /* This might fail because the kernel or file system doesn't support idmapping. We
3815 * can't really distinguish this nicely, nor do we have any guarantees about the
3816 * error codes we see, could be EOPNOTSUPP or EINVAL. */
3817 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_AUTO)
3818 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3819 "ID mapped mounts are apparently not available, sorry.");
3820
3821 log_debug("ID mapped mounts are apparently not available on this kernel or for the selected file system, reverting to recursive chown()ing.");
3822 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3823 } else if (r < 0)
3824 return log_error_errno(r, "Failed to set up ID mapped mounts: %m");
3825 else {
3826 log_debug("ID mapped mounts available, making use of them.");
3827 idmap = true;
3828 }
3829 }
3830
2d3a5a73
LP		 3831 if (dissected_image) {
3832 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
d04faa4e
LP		 3833 r = dissected_image_mount(
3834 dissected_image,
3835 directory,
3836 arg_uid_shift,
21b61b1d 3837 arg_uid_range,
d04faa4e
LP		 3838 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|
3839 DISSECT_IMAGE_DISCARD_ON_LOOP|
3840 DISSECT_IMAGE_USR_NO_ROOT|
f61c7f88
LP		 3841 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3842 (idmap ? DISSECT_IMAGE_MOUNT_IDMAPPED : 0));
4fcb96ce
LP		 3843 if (r == -EUCLEAN)
3844 return log_error_errno(r, "File system check for image failed: %m");
2d3a5a73 3845 if (r < 0)
4fcb96ce 3846 return log_error_errno(r, "Failed to mount image file system: %m");
2d3a5a73
LP		 3847 }
3848
8199d554
LP		 3849 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3850 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3851
3852 r = detect_unified_cgroup_hierarchy_from_image(directory);
3853 if (r < 0)
3854 return r;
3855
fefb7a6d 3856 l = send(fd_outer_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
8199d554
LP		 3857 if (l < 0)
3858 return log_error_errno(errno, "Failed to send cgroup mode: %m");
baaa35ad
ZJS		 3859 if (l != sizeof(arg_unified_cgroup_hierarchy))
3860 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3861 "Short write while sending cgroup mode.");
8199d554
LP		 3862 }
3863
4ad14eff
LP		 3864 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3865 if (r < 0)
3866 return r;
3867
03cfe0d5
LP		 3868 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3869 if (r < 0)
3870 return r;
3871
bbd407ea
DDM		 3872 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3873 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
64e82c19 3874 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
03cfe0d5
LP		 3875 if (r < 0)
3876 return log_error_errno(r, "Failed to make tree read-only: %m");
3877 }
3878
0de7acce 3879 r = mount_all(directory,
4f086aab 3880 arg_mount_settings,
0de7acce 3881 arg_uid_shift,
0de7acce 3882 arg_selinux_apifs_context);
03cfe0d5
LP		 3883 if (r < 0)
3884 return r;
3885
07fa00f9
LP		 3886 r = copy_devnodes(directory);
3887 if (r < 0)
03cfe0d5
LP		 3888 return r;
3889
de40a303
LP		 3890 r = make_extra_nodes(directory);
3891 if (r < 0)
3892 return r;
3893
3894 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
e5f10caf 3895
9fac5029 3896 p = prefix_roota(directory, "/run/host");
e5f10caf 3897 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
03cfe0d5 3898
07fa00f9
LP		 3899 r = setup_pts(directory);
3900 if (r < 0)
03cfe0d5
LP		 3901 return r;
3902
e79581dd 3903 r = mount_tunnel_dig(directory);
03cfe0d5
LP		 3904 if (r < 0)
3905 return r;
3906
8e5430c4
LP		 3907 r = setup_keyring();
3908 if (r < 0)
3909 return r;
3910
3652872a
LP		 3911 r = setup_credentials(directory);
3912 if (r < 0)
3913 return r;
3914
2f893044
LP		 3915 r = bind_user_setup(bind_user_context, directory);
3916 if (r < 0)
3917 return r;
3918
5c4deb9a
MJ		 3919 r = mount_custom(
3920 directory,
3921 arg_custom_mounts,
3922 arg_n_custom_mounts,
3923 arg_uid_shift,
c0c8f718 3924 arg_uid_range,
5c4deb9a
MJ		 3925 arg_selinux_apifs_context,
3926 MOUNT_NON_ROOT_ONLY);
3927 if (r < 0)
3928 return r;
3929
03cfe0d5
LP		 3930 r = setup_timezone(directory);
3931 if (r < 0)
3932 return r;
3933
3934 r = setup_resolv_conf(directory);
3935 if (r < 0)
3936 return r;
3937
e01ff70a
MS		 3938 r = setup_machine_id(directory);
3939 if (r < 0)
3940 return r;
3941
03cfe0d5
LP		 3942 r = setup_journal(directory);
3943 if (r < 0)
3944 return r;
3945
0f48ba7b
LP		 3946 /* The same stuff as the $container env var, but nicely readable for the entire payload */
3947 p = prefix_roota(directory, "/run/host/container-manager");
3948 (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE);
3949
3950 /* The same stuff as the $container_uuid env var */
3951 p = prefix_roota(directory, "/run/host/container-uuid");
3952 (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
3953
489fae52 3954 if (!arg_use_cgns) {
0996ef00
CB		 3955 r = mount_cgroups(
3956 directory,
3957 arg_unified_cgroup_hierarchy,
3958 arg_userns_mode != USER_NAMESPACE_NO,
3959 arg_uid_shift,
3960 arg_uid_range,
5a8ff0e6 3961 arg_selinux_apifs_context,
ada54120 3962 false);
0996ef00
CB		 3963 if (r < 0)
3964 return r;
3965 }
03cfe0d5 3966
57c10a56
CB		 3967 /* Mark everything as shared so our mounts get propagated down. This is required to make new bind
3968 * mounts available in systemd services inside the container that create a new mount namespace. See
3969 * https://github.com/systemd/systemd/issues/3860 Further submounts (such as /dev) done after this
3970 * will inherit the shared propagation mode.
3971 *
3972 * IMPORTANT: Do not overmount the root directory anymore from now on to enable moving the root
3973 * directory mount to root later on.
3974 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3975 */
3976 r = mount_switch_root(directory, MOUNT_ATTR_PROPAGATION_SHARED);
03cfe0d5
LP		 3977 if (r < 0)
3978 return log_error_errno(r, "Failed to move root directory: %m");
3979
e79581dd
CB		 3980 /* We finished setting up the rootfs which is a shared mount. The mount tunnel needs to be a
3981 * dependent mount otherwise we can't MS_MOVE mounts that were propagated from the host into
3982 * the container. */
3983 r = mount_tunnel_open();
3984 if (r < 0)
3985 return r;
3986
b71a0192
CB		 3987 if (arg_userns_mode != USER_NAMESPACE_NO) {
3988 /* In order to mount procfs and sysfs in an unprivileged container the kernel
3989 * requires that a fully visible instance is already present in the target mount
3990 * namespace. Mount one here so the inner child can mount its own instances. Later
3991 * we umount the temporary instances created here before we actually exec the
3992 * payload. Since the rootfs is shared the umount will propagate into the container.
3993 * Note, the inner child wouldn't be able to unmount the instances on its own since
3994 * it doesn't own the originating mount namespace. IOW, the outer child needs to do
3995 * this. */
3996 r = pin_fully_visible_fs();
3997 if (r < 0)
3998 return r;
3999 }
4000
e96ceaba 4001 fd = setup_notify_child();
9c1e04d0
AP		 4002 if (fd < 0)
4003 return fd;
4004
03cfe0d5 4005 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
0c582db0 4006 arg_clone_ns_flags |
8869a0b4 4007 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
03cfe0d5
LP		 4008 if (pid < 0)
4009 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5 4010 if (pid == 0) {
af06cd30 4011 fd_outer_socket = safe_close(fd_outer_socket);
03cfe0d5 4012
2a2e78e9
LP		 4013 /* The inner child has all namespaces that are requested, so that we all are owned by the
4014 * user if user namespaces are turned on. */
03cfe0d5 4015
d7bea6b6
DP		 4016 if (arg_network_namespace_path) {
4017 r = namespace_enter(-1, -1, netns_fd, -1, -1);
4018 if (r < 0)
e2d39e54 4019 return log_error_errno(r, "Failed to join network namespace: %m");
d7bea6b6
DP		 4020 }
4021
bb1aa185 4022 r = inner_child(barrier, directory, secondary, fd_inner_socket, fds, os_release_pairs);
03cfe0d5
LP		 4023 if (r < 0)
4024 _exit(EXIT_FAILURE);
4025
4026 _exit(EXIT_SUCCESS);
4027 }
4028
af06cd30 4029 l = send(fd_outer_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
03cfe0d5
LP		 4030 if (l < 0)
4031 return log_error_errno(errno, "Failed to send PID: %m");
baaa35ad
ZJS		 4032 if (l != sizeof(pid))
4033 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4034 "Short write while sending PID.");
03cfe0d5 4035
af06cd30 4036 l = send(fd_outer_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
e01ff70a
MS		 4037 if (l < 0)
4038 return log_error_errno(errno, "Failed to send machine ID: %m");
baaa35ad
ZJS		 4039 if (l != sizeof(arg_uuid))
4040 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4041 "Short write while sending machine ID.");
e01ff70a 4042
af06cd30 4043 l = send_one_fd(fd_outer_socket, fd, 0);
9c1e04d0 4044 if (l < 0)
ba72801d 4045 return log_error_errno(l, "Failed to send notify fd: %m");
9c1e04d0 4046
af06cd30 4047 fd_outer_socket = safe_close(fd_outer_socket);
5d9d3fcb 4048 fd_inner_socket = safe_close(fd_inner_socket);
d7bea6b6 4049 netns_fd = safe_close(netns_fd);
03cfe0d5
LP		 4050
4051 return 0;
4052}
4053
0e7ac751 4054static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
d381c8a6 4055 bool tried_hashed = false;
0e7ac751
LP		 4056 unsigned n_tries = 100;
4057 uid_t candidate;
4058 int r;
4059
4060 assert(shift);
4061 assert(ret_lock_file);
0de7acce 4062 assert(arg_userns_mode == USER_NAMESPACE_PICK);
0e7ac751
LP		 4063 assert(arg_uid_range == 0x10000U);
4064
4065 candidate = *shift;
4066
4067 (void) mkdir("/run/systemd/nspawn-uid", 0755);
4068
4069 for (;;) {
fbd0b64f 4070 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
8e766630 4071 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
0e7ac751
LP		 4072
4073 if (--n_tries <= 0)
4074 return -EBUSY;
4075
87d5e4f2 4076 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
0e7ac751
LP		 4077 goto next;
4078 if ((candidate & UINT32_C(0xFFFF)) != 0)
4079 goto next;
4080
4081 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
4082 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
4083 if (r == -EBUSY) /* Range already taken by another nspawn instance */
4084 goto next;
4085 if (r < 0)
4086 return r;
4087
4088 /* Make some superficial checks whether the range is currently known in the user database */
4089 if (getpwuid(candidate))
4090 goto next;
4091 if (getpwuid(candidate + UINT32_C(0xFFFE)))
4092 goto next;
4093 if (getgrgid(candidate))
4094 goto next;
4095 if (getgrgid(candidate + UINT32_C(0xFFFE)))
4096 goto next;
4097
4098 *ret_lock_file = lf;
4099 lf = (struct LockFile) LOCK_FILE_INIT;
4100 *shift = candidate;
4101 return 0;
4102
4103 next:
d381c8a6
LP		 4104 if (arg_machine && !tried_hashed) {
4105 /* Try to hash the base from the container name */
4106
4107 static const uint8_t hash_key[] = {
4108 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
4109 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
4110 };
4111
4112 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
4113
4114 tried_hashed = true;
4115 } else
4116 random_bytes(&candidate, sizeof(candidate));
4117
87d5e4f2 4118 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
0e7ac751
LP		 4119 candidate &= (uid_t) UINT32_C(0xFFFF0000);
4120 }
4121}
4122
2f893044
LP		 4123static int add_one_uid_map(
4124 char **p,
4125 uid_t container_uid,
4126 uid_t host_uid,
4127 uid_t range) {
4128
4129 return strextendf(p,
4130 UID_FMT " " UID_FMT " " UID_FMT "\n",
4131 container_uid, host_uid, range);
4132}
4133
4134static int make_uid_map_string(
4135 const uid_t bind_user_uid[],
4136 size_t n_bind_user_uid,
4137 size_t offset,
4138 char **ret) {
4139
4140 _cleanup_free_ char *s = NULL;
4141 uid_t previous_uid = 0;
4142 int r;
4143
4144 assert(n_bind_user_uid == 0 || bind_user_uid);
2f092762 4145 assert(IN_SET(offset, 0, 2)); /* used to switch between UID and GID map */
2f893044
LP		 4146 assert(ret);
4147
4148 /* The bind_user_uid[] array is a series of 4 uid_t values, for each --bind-user= entry one
4149 * quadruplet, consisting of host and container UID + GID. */
4150
4151 for (size_t i = 0; i < n_bind_user_uid; i++) {
05ab439a
YW		 4152 uid_t payload_uid = bind_user_uid[i*4+offset],
4153 host_uid = bind_user_uid[i*4+offset+1];
2f893044
LP		 4154
4155 assert(previous_uid <= payload_uid);
4156 assert(payload_uid < arg_uid_range);
4157
4158 /* Add a range to close the gap to previous entry */
4159 if (payload_uid > previous_uid) {
4160 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, payload_uid - previous_uid);
4161 if (r < 0)
4162 return r;
4163 }
4164
4165 /* Map this specific user */
4166 r = add_one_uid_map(&s, payload_uid, host_uid, 1);
4167 if (r < 0)
4168 return r;
4169
4170 previous_uid = payload_uid + 1;
4171 }
4172
4173 /* And add a range to close the gap to finish the range */
4174 if (arg_uid_range > previous_uid) {
4175 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, arg_uid_range - previous_uid);
4176 if (r < 0)
4177 return r;
4178 }
4179
4180 assert(s);
4181
4182 *ret = TAKE_PTR(s);
4183 return 0;
4184}
4185
4186static int setup_uid_map(
4187 pid_t pid,
4188 const uid_t bind_user_uid[],
4189 size_t n_bind_user_uid) {
4190
4191 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1];
4192 _cleanup_free_ char *s = NULL;
03cfe0d5
LP		 4193 int r;
4194
4195 assert(pid > 1);
4196
2f893044
LP		 4197 /* Build the UID map string */
4198 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 0, &s) < 0) /* offset=0 contains the UID pair */
4199 return log_oom();
4200
03cfe0d5 4201 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
2f893044 4202 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4203 if (r < 0)
4204 return log_error_errno(r, "Failed to write UID map: %m");
4205
2f893044
LP		 4206 /* And now build the GID map string */
4207 s = mfree(s);
4208 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 2, &s) < 0) /* offset=2 contains the GID pair */
4209 return log_oom();
4210
03cfe0d5 4211 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
2f893044 4212 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4213 if (r < 0)
4214 return log_error_errno(r, "Failed to write GID map: %m");
4215
4216 return 0;
4217}
4218
9c1e04d0 4219static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
9c1e04d0
AP		 4220 char buf[NOTIFY_BUFFER_MAX+1];
4221 char *p = NULL;
4222 struct iovec iovec = {
4223 .iov_base = buf,
4224 .iov_len = sizeof(buf)-1,
4225 };
fb29cdbe
LP		 4226 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
4227 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
9c1e04d0
AP		 4228 struct msghdr msghdr = {
4229 .msg_iov = &iovec,
4230 .msg_iovlen = 1,
4231 .msg_control = &control,
4232 .msg_controllen = sizeof(control),
4233 };
371d72e0 4234 struct ucred *ucred;
9c1e04d0
AP		 4235 ssize_t n;
4236 pid_t inner_child_pid;
4237 _cleanup_strv_free_ char **tags = NULL;
4bf4f50f 4238 int r;
9c1e04d0
AP		 4239
4240 assert(userdata);
4241
4242 inner_child_pid = PTR_TO_PID(userdata);
4243
4244 if (revents != EPOLLIN) {
4245 log_warning("Got unexpected poll event for notify fd.");
4246 return 0;
4247 }
4248
3691bcf3 4249 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
8add30a0
YW		 4250 if (n < 0) {
4251 if (ERRNO_IS_TRANSIENT(n))
4252 return 0;
4253 if (n == -EXFULL) {
4254 log_warning("Got message with truncated control data (too many fds sent?), ignoring.");
4255 return 0;
4256 }
3691bcf3 4257 return log_warning_errno(n, "Couldn't read notification socket: %m");
8add30a0 4258 }
9c1e04d0 4259
9c1e04d0
AP		 4260 cmsg_close_all(&msghdr);
4261
371d72e0 4262 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
9c1e04d0 4263 if (!ucred || ucred->pid != inner_child_pid) {
8cb57430 4264 log_debug("Received notify message without valid credentials. Ignoring.");
9c1e04d0
AP		 4265 return 0;
4266 }
4267
4268 if ((size_t) n >= sizeof(buf)) {
4269 log_warning("Received notify message exceeded maximum size. Ignoring.");
4270 return 0;
4271 }
4272
4273 buf[n] = 0;
4274 tags = strv_split(buf, "\n\r");
4275 if (!tags)
4276 return log_oom();
4277
d29cc4d6 4278 if (strv_contains(tags, "READY=1")) {
d4341b76 4279 r = sd_notify(false, "READY=1\n");
4bf4f50f
ZJS		 4280 if (r < 0)
4281 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
4282 }
9c1e04d0
AP		 4283
4284 p = strv_find_startswith(tags, "STATUS=");
4285 if (p)
04f590a4 4286 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
9c1e04d0
AP		 4287
4288 return 0;
4289}
4290
e96ceaba 4291static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
9c1e04d0 4292 int r;
9c1e04d0 4293
5773024d 4294 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
9c1e04d0
AP		 4295 if (r < 0)
4296 return log_error_errno(r, "Failed to allocate notify event source: %m");
4297
5773024d 4298 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
9c1e04d0
AP		 4299
4300 return 0;
4301}
4302
5d961407
LP		 4303static int merge_settings(Settings *settings, const char *path) {
4304 int rl;
f757855e 4305
5d961407
LP		 4306 assert(settings);
4307 assert(path);
f757855e 4308
5d961407
LP		 4309 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
4310 * that this steals the fields of the Settings* structure, and hence modifies it. */
f757855e 4311
7732f92b
LP		 4312 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
4313 settings->start_mode >= 0) {
4314 arg_start_mode = settings->start_mode;
130d3d22 4315 strv_free_and_replace(arg_parameters, settings->parameters);
f757855e
LP		 4316 }
4317
d3689b94
LP		 4318 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
4319 settings->ephemeral >= 0)
a2f577fc
JL		 4320 arg_ephemeral = settings->ephemeral;
4321
de40a303
LP		 4322 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
4323 settings->root) {
4324
4325 if (!arg_settings_trusted)
4326 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
4327 else
4328 free_and_replace(arg_directory, settings->root);
4329 }
4330
b53ede69
PW		 4331 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
4332 settings->pivot_root_new) {
4333 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
4334 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
4335 }
4336
5f932eb9 4337 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
1cc6c93a
YW		 4338 settings->working_directory)
4339 free_and_replace(arg_chdir, settings->working_directory);
5f932eb9 4340
f757855e 4341 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
130d3d22
YW		 4342 settings->environment)
4343 strv_free_and_replace(arg_setenv, settings->environment);
f757855e 4344
de40a303
LP		 4345 if ((arg_settings_mask & SETTING_USER) == 0) {
4346
4347 if (settings->user)
4348 free_and_replace(arg_user, settings->user);
4349
4350 if (uid_is_valid(settings->uid))
4351 arg_uid = settings->uid;
4352 if (gid_is_valid(settings->gid))
4353 arg_gid = settings->gid;
4354 if (settings->n_supplementary_gids > 0) {
4355 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
4356 arg_n_supplementary_gids = settings->n_supplementary_gids;
4357 }
4358 }
f757855e
LP		 4359
4360 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
a3fc6b55 4361 uint64_t plus, minus;
7be830c6 4362 uint64_t network_minus = 0;
88fc9c9b 4363 uint64_t ambient;
f757855e 4364
de40a303
LP		 4365 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
4366 * Settings structure */
4367
0e265674 4368 plus = settings->capability;
a3fc6b55
LP		 4369 minus = settings->drop_capability;
4370
9baa294c
LP		 4371 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4372 settings_network_configured(settings)) {
a3fc6b55
LP		 4373 if (settings_private_network(settings))
4374 plus |= UINT64_C(1) << CAP_NET_ADMIN;
4375 else
7be830c6 4376 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
a3fc6b55 4377 }
0e265674
LP		 4378
4379 if (!arg_settings_trusted && plus != 0) {
4380 if (settings->capability != 0)
5d961407 4381 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
7be830c6
TH		 4382 } else {
4383 arg_caps_retain &= ~network_minus;
520e0d54 4384 arg_caps_retain |= plus;
7be830c6 4385 }
f757855e 4386
a3fc6b55 4387 arg_caps_retain &= ~minus;
de40a303
LP		 4388
4389 /* Copy the full capabilities over too */
4390 if (capability_quintet_is_set(&settings->full_capabilities)) {
4391 if (!arg_settings_trusted)
5238e957 4392 log_warning("Ignoring capability settings, file %s is not trusted.", path);
de40a303
LP		 4393 else
4394 arg_full_capabilities = settings->full_capabilities;
4395 }
88fc9c9b
TH		 4396
4397 ambient = settings->ambient_capability;
4398 if (!arg_settings_trusted && ambient != 0)
4399 log_warning("Ignoring AmbientCapability= setting, file %s is not trusted.", path);
4400 else
4401 arg_caps_ambient |= ambient;
f757855e
LP		 4402 }
4403
4404 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
4405 settings->kill_signal > 0)
4406 arg_kill_signal = settings->kill_signal;
4407
4408 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
4409 settings->personality != PERSONALITY_INVALID)
4410 arg_personality = settings->personality;
4411
4412 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
4413 !sd_id128_is_null(settings->machine_id)) {
4414
4415 if (!arg_settings_trusted)
5d961407 4416 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
f757855e
LP		 4417 else
4418 arg_uuid = settings->machine_id;
4419 }
4420
4421 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
4422 settings->read_only >= 0)
4423 arg_read_only = settings->read_only;
4424
4425 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
4426 settings->volatile_mode != _VOLATILE_MODE_INVALID)
4427 arg_volatile_mode = settings->volatile_mode;
4428
4429 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
4430 settings->n_custom_mounts > 0) {
4431
4432 if (!arg_settings_trusted)
5d961407 4433 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
f757855e
LP		 4434 else {
4435 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
1cc6c93a 4436 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
f757855e 4437 arg_n_custom_mounts = settings->n_custom_mounts;
f757855e
LP		 4438 settings->n_custom_mounts = 0;
4439 }
4440 }
4441
4442 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
a1dfd585 4443 settings_network_configured(settings)) {
f757855e
LP		 4444
4445 if (!arg_settings_trusted)
5d961407 4446 log_warning("Ignoring network settings, file %s is not trusted.", path);
f757855e 4447 else {
f6d6bad1 4448 arg_network_veth = settings_network_veth(settings);
0e265674
LP		 4449 arg_private_network = settings_private_network(settings);
4450
130d3d22
YW		 4451 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
4452 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
4453 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
4454 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
f6d6bad1 4455
1cc6c93a
YW		 4456 free_and_replace(arg_network_bridge, settings->network_bridge);
4457 free_and_replace(arg_network_zone, settings->network_zone);
de40a303
LP		 4458
4459 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
f757855e
LP		 4460 }
4461 }
4462
4463 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
4464 settings->expose_ports) {
4465
4466 if (!arg_settings_trusted)
5d961407 4467 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
f757855e
LP		 4468 else {
4469 expose_port_free_all(arg_expose_ports);
1cc6c93a 4470 arg_expose_ports = TAKE_PTR(settings->expose_ports);
f757855e
LP		 4471 }
4472 }
4473
0de7acce
LP		 4474 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
4475 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
4476
4477 if (!arg_settings_trusted)
5d961407 4478 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
0de7acce
LP		 4479 else {
4480 arg_userns_mode = settings->userns_mode;
4481 arg_uid_shift = settings->uid_shift;
4482 arg_uid_range = settings->uid_range;
6c045a99 4483 arg_userns_ownership = settings->userns_ownership;
0de7acce
LP		 4484 }
4485 }
4486
0cc3c9f9
LP		 4487 if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
4488 !strv_isempty(settings->bind_user))
2f893044
LP		 4489 strv_free_and_replace(arg_bind_user, settings->bind_user);
4490
d3689b94
LP		 4491 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
4492 settings->notify_ready >= 0)
9c1e04d0
AP		 4493 arg_notify_ready = settings->notify_ready;
4494
960e4569
LP		 4495 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
4496
2d09ea44
LP		 4497 if (!strv_isempty(settings->syscall_allow_list) || !strv_isempty(settings->syscall_deny_list)) {
4498 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
4499 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
4500 else {
4501 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4502 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
4503 }
960e4569 4504 }
de40a303
LP		 4505
4506#if HAVE_SECCOMP
2d09ea44
LP		 4507 if (settings->seccomp) {
4508 if (!arg_settings_trusted)
4509 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4510 else {
4511 seccomp_release(arg_seccomp);
4512 arg_seccomp = TAKE_PTR(settings->seccomp);
4513 }
de40a303
LP		 4514 }
4515#endif
960e4569
LP		 4516 }
4517
bf428efb
LP		 4518 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4519 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4520 continue;
4521
4522 if (!settings->rlimit[rl])
4523 continue;
4524
4525 if (!arg_settings_trusted) {
5d961407 4526 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
bf428efb
LP		 4527 continue;
4528 }
4529
4530 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4531 }
4532
3a9530e5
LP		 4533 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4534 settings->hostname)
4535 free_and_replace(arg_hostname, settings->hostname);
4536
66edd963
LP		 4537 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4538 settings->no_new_privileges >= 0)
4539 arg_no_new_privileges = settings->no_new_privileges;
4540
81f345df
LP		 4541 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4542 settings->oom_score_adjust_set) {
4543
4544 if (!arg_settings_trusted)
5d961407 4545 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
81f345df
LP		 4546 else {
4547 arg_oom_score_adjust = settings->oom_score_adjust;
4548 arg_oom_score_adjust_set = true;
4549 }
4550 }
4551
d107bb7d 4552 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
0985c7c4 4553 settings->cpu_set.set) {
d107bb7d
LP		 4554
4555 if (!arg_settings_trusted)
5d961407 4556 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
d107bb7d 4557 else {
0985c7c4
ZJS		 4558 cpu_set_reset(&arg_cpu_set);
4559 arg_cpu_set = settings->cpu_set;
4560 settings->cpu_set = (CPUSet) {};
d107bb7d
LP		 4561 }
4562 }
4563
09d423e9
LP		 4564 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4565 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4566 arg_resolv_conf = settings->resolv_conf;
4567
4e1d6aa9
LP		 4568 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4569 settings->link_journal != _LINK_JOURNAL_INVALID) {
4570
4571 if (!arg_settings_trusted)
4572 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4573 else {
4574 arg_link_journal = settings->link_journal;
4575 arg_link_journal_try = settings->link_journal_try;
4576 }
4577 }
4578
1688841f
LP		 4579 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4580 settings->timezone != _TIMEZONE_MODE_INVALID)
4581 arg_timezone = settings->timezone;
4582
de40a303
LP		 4583 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4584 settings->slice) {
4585
4586 if (!arg_settings_trusted)
4587 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4588 else
4589 free_and_replace(arg_slice, settings->slice);
4590 }
4591
4592 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4593 settings->use_cgns >= 0) {
4594
4595 if (!arg_settings_trusted)
4596 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4597 else
4598 arg_use_cgns = settings->use_cgns;
4599 }
4600
4601 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
f5fbe71d 4602 settings->clone_ns_flags != ULONG_MAX) {
de40a303
LP		 4603
4604 if (!arg_settings_trusted)
4605 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4606 else
4607 arg_clone_ns_flags = settings->clone_ns_flags;
4608 }
4609
4610 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4611 settings->console_mode >= 0) {
4612
4613 if (!arg_settings_trusted)
4614 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4615 else
4616 arg_console_mode = settings->console_mode;
4617 }
4618
d3689b94
LP		 4619 if ((arg_settings_mask & SETTING_SUPPRESS_SYNC) == 0 &&
4620 settings->suppress_sync >= 0)
4a4654e0
LP		 4621 arg_suppress_sync = settings->suppress_sync;
4622
de40a303
LP		 4623 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4624 * don't consult arg_settings_mask for them. */
4625
4626 sd_bus_message_unref(arg_property_message);
4627 arg_property_message = TAKE_PTR(settings->properties);
4628
4629 arg_console_width = settings->console_width;
4630 arg_console_height = settings->console_height;
4631
b2645747 4632 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
de40a303
LP		 4633 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4634 arg_n_extra_nodes = settings->n_extra_nodes;
4635
f757855e
LP		 4636 return 0;
4637}
4638
5d961407
LP		 4639static int load_settings(void) {
4640 _cleanup_(settings_freep) Settings *settings = NULL;
4641 _cleanup_fclose_ FILE *f = NULL;
3603f151 4642 _cleanup_free_ char *p = NULL;
5d961407
LP		 4643 int r;
4644
de40a303
LP		 4645 if (arg_oci_bundle)
4646 return 0;
4647
5d961407
LP		 4648 /* If all settings are masked, there's no point in looking for
4649 * the settings file */
d7a0f1f4 4650 if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
5d961407
LP		 4651 return 0;
4652
5d961407
LP		 4653 /* We first look in the admin's directories in /etc and /run */
4654 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4655 _cleanup_free_ char *j = NULL;
4656
3603f151 4657 j = path_join(i, arg_settings_filename);
5d961407
LP		 4658 if (!j)
4659 return log_oom();
4660
4661 f = fopen(j, "re");
4662 if (f) {
4663 p = TAKE_PTR(j);
4664
4665 /* By default, we trust configuration from /etc and /run */
4666 if (arg_settings_trusted < 0)
4667 arg_settings_trusted = true;
4668
4669 break;
4670 }
4671
4672 if (errno != ENOENT)
4673 return log_error_errno(errno, "Failed to open %s: %m", j);
4674 }
4675
4676 if (!f) {
4677 /* After that, let's look for a file next to the
4678 * actual image we shall boot. */
4679
4680 if (arg_image) {
3603f151 4681 p = file_in_same_dir(arg_image, arg_settings_filename);
5d961407
LP		 4682 if (!p)
4683 return log_oom();
cd6e3914 4684 } else if (arg_directory && !path_equal(arg_directory, "/")) {
3603f151 4685 p = file_in_same_dir(arg_directory, arg_settings_filename);
5d961407
LP		 4686 if (!p)
4687 return log_oom();
4688 }
4689
4690 if (p) {
4691 f = fopen(p, "re");
4692 if (!f && errno != ENOENT)
4693 return log_error_errno(errno, "Failed to open %s: %m", p);
4694
4695 /* By default, we do not trust configuration from /var/lib/machines */
4696 if (arg_settings_trusted < 0)
4697 arg_settings_trusted = false;
4698 }
4699 }
4700
4701 if (!f)
4702 return 0;
4703
4704 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4705
4706 r = settings_load(f, p, &settings);
4707 if (r < 0)
4708 return r;
4709
4710 return merge_settings(settings, p);
4711}
4712
de40a303
LP		 4713static int load_oci_bundle(void) {
4714 _cleanup_(settings_freep) Settings *settings = NULL;
4715 int r;
4716
4717 if (!arg_oci_bundle)
4718 return 0;
4719
4720 /* By default let's trust OCI bundles */
4721 if (arg_settings_trusted < 0)
4722 arg_settings_trusted = true;
4723
4724 r = oci_load(NULL, arg_oci_bundle, &settings);
4725 if (r < 0)
4726 return r;
4727
4728 return merge_settings(settings, arg_oci_bundle);
4729}
4730
3acc84eb 4731static int run_container(
2d845785 4732 DissectedImage *dissected_image,
b0067625
ZJS		 4733 bool secondary,
4734 FDSet *fds,
4735 char veth_name[IFNAMSIZ], bool *veth_created,
761cf19d 4736 struct ExposeArgs *expose_args,
3acc84eb 4737 int *master, pid_t *pid, int *ret) {
b0067625
ZJS		 4738
4739 static const struct sigaction sa = {
4740 .sa_handler = nop_signal_handler,
e28c7cd0 4741 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
b0067625
ZJS		 4742 };
4743
8e766630 4744 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
b0067625
ZJS		 4745 _cleanup_close_ int etc_passwd_lock = -1;
4746 _cleanup_close_pair_ int
5d9d3fcb 4747 fd_inner_socket_pair[2] = { -EBADF, -EBADF },
fefb7a6d 4748 fd_outer_socket_pair[2] = { -EBADF, -EBADF };
8199d554 4749
5d9d3fcb 4750 _cleanup_close_ int notify_socket = -1, mntns_fd = -EBADF, fd_kmsg_fifo = -EBADF;
b0067625 4751 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
5773024d 4752 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
b0067625
ZJS		 4753 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4754 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4755 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
abdb9b08 4756 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2f893044
LP		 4757 _cleanup_free_ uid_t *bind_user_uid = NULL;
4758 size_t n_bind_user_uid = 0;
b0067625 4759 ContainerStatus container_status = 0;
b0067625
ZJS		 4760 int ifi = 0, r;
4761 ssize_t l;
4762 sigset_t mask_chld;
5b4855ab 4763 _cleanup_close_ int child_netns_fd = -1;
b0067625
ZJS		 4764
4765 assert_se(sigemptyset(&mask_chld) == 0);
4766 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4767
4768 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4769 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4770 * check with getpwuid() if the specific user already exists. Note that /etc might be
4771 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4772 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4773 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4774 * really ours. */
4775
4776 etc_passwd_lock = take_etc_passwd_lock(NULL);
4777 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4778 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4779 }
4780
4781 r = barrier_create(&barrier);
4782 if (r < 0)
4783 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4784
5d9d3fcb
CB		 4785 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_inner_socket_pair) < 0)
4786 return log_error_errno(errno, "Failed to create inner socket pair: %m");
4787
af06cd30
CB		 4788 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, fd_outer_socket_pair) < 0)
4789 return log_error_errno(errno, "Failed to create outer socket pair: %m");
b0067625 4790
b0067625
ZJS		 4791 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4792 * parent's blocking calls and give it a chance to call wait() and terminate. */
4793 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4794 if (r < 0)
4795 return log_error_errno(errno, "Failed to change the signal mask: %m");
4796
4797 r = sigaction(SIGCHLD, &sa, NULL);
4798 if (r < 0)
4799 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4800
d7bea6b6 4801 if (arg_network_namespace_path) {
5b4855ab
DDM		 4802 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4803 if (child_netns_fd < 0)
d7bea6b6
DP		 4804 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4805
54c2459d 4806 r = fd_is_ns(child_netns_fd, CLONE_NEWNET);
6619ad88
LP		 4807 if (r == -EUCLEAN)
4808 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4809 else if (r < 0)
d7bea6b6 4810 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
c6147113
LP		 4811 else if (r == 0)
4812 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4813 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
d7bea6b6
DP		 4814 }
4815
b0067625
ZJS		 4816 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4817 if (*pid < 0)
4818 return log_error_errno(errno, "clone() failed%s: %m",
4819 errno == EINVAL ?
4820 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4821
4822 if (*pid == 0) {
4823 /* The outer child only has a file system namespace. */
4824 barrier_set_role(&barrier, BARRIER_CHILD);
4825
5d9d3fcb 4826 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
af06cd30 4827 fd_outer_socket_pair[0] = safe_close(fd_outer_socket_pair[0]);
b0067625
ZJS		 4828
4829 (void) reset_all_signal_handlers();
4830 (void) reset_signal_mask();
4831
4832 r = outer_child(&barrier,
4833 arg_directory,
2d845785 4834 dissected_image,
b0067625 4835 secondary,
af06cd30 4836 fd_outer_socket_pair[1],
5d9d3fcb 4837 fd_inner_socket_pair[1],
d7bea6b6 4838 fds,
5b4855ab 4839 child_netns_fd);
b0067625
ZJS		 4840 if (r < 0)
4841 _exit(EXIT_FAILURE);
4842
4843 _exit(EXIT_SUCCESS);
4844 }
4845
4846 barrier_set_role(&barrier, BARRIER_PARENT);
4847
e4077ff6 4848 fdset_close(fds);
b0067625 4849
5d9d3fcb 4850 fd_inner_socket_pair[1] = safe_close(fd_inner_socket_pair[1]);
af06cd30 4851 fd_outer_socket_pair[1] = safe_close(fd_outer_socket_pair[1]);
b0067625
ZJS		 4852
4853 if (arg_userns_mode != USER_NAMESPACE_NO) {
af06cd30 4854 mntns_fd = receive_one_fd(fd_outer_socket_pair[0], 0);
b71a0192
CB		 4855 if (mntns_fd < 0)
4856 return log_error_errno(mntns_fd, "Failed to receive mount namespace fd from outer child: %m");
4857
b0067625 4858 /* The child just let us know the UID shift it might have read from the image. */
af06cd30 4859 l = recv(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
b0067625
ZJS		 4860 if (l < 0)
4861 return log_error_errno(errno, "Failed to read UID shift: %m");
c6147113
LP		 4862 if (l != sizeof arg_uid_shift)
4863 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
b0067625
ZJS		 4864
4865 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4866 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4867 * image, but if that's already in use, pick a new one, and report back to the child,
4868 * which one we now picked. */
4869
4870 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4871 if (r < 0)
4872 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4873
af06cd30 4874 l = send(fd_outer_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
b0067625
ZJS		 4875 if (l < 0)
4876 return log_error_errno(errno, "Failed to send UID shift: %m");
c6147113
LP		 4877 if (l != sizeof arg_uid_shift)
4878 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
b0067625 4879 }
2f893044
LP		 4880
4881 n_bind_user_uid = strv_length(arg_bind_user);
4882 if (n_bind_user_uid > 0) {
4883 /* Right after the UID shift, we'll receive the list of UID mappings for the
4884 * --bind-user= logic. Always a quadruplet of payload and host UID + GID. */
4885
4886 bind_user_uid = new(uid_t, n_bind_user_uid*4);
4887 if (!bind_user_uid)
4888 return log_oom();
4889
4890 for (size_t i = 0; i < n_bind_user_uid; i++) {
af06cd30 4891 l = recv(fd_outer_socket_pair[0], bind_user_uid + i*4, sizeof(uid_t)*4, 0);
2f893044
LP		 4892 if (l < 0)
4893 return log_error_errno(errno, "Failed to read user UID map pair: %m");
4894 if (l != sizeof(uid_t)*4)
4895 return log_full_errno(l == 0 ? LOG_DEBUG : LOG_WARNING,
4896 SYNTHETIC_ERRNO(EIO),
4897 "Short read while reading bind user UID pairs.");
4898 }
4899 }
b0067625
ZJS		 4900 }
4901
8199d554
LP		 4902 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4903 /* The child let us know the support cgroup mode it might have read from the image. */
fefb7a6d 4904 l = recv(fd_outer_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
8199d554
LP		 4905 if (l < 0)
4906 return log_error_errno(errno, "Failed to read cgroup mode: %m");
c6147113 4907 if (l != sizeof(arg_unified_cgroup_hierarchy))
c0f86d66 4908 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
c6147113 4909 l, l == 0 ? " The child is most likely dead." : "");
8199d554
LP		 4910 }
4911
b0067625 4912 /* Wait for the outer child. */
d2e0ac3d
LP		 4913 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4914 if (r < 0)
4915 return r;
4916 if (r != EXIT_SUCCESS)
4917 return -EIO;
b0067625
ZJS		 4918
4919 /* And now retrieve the PID of the inner child. */
af06cd30 4920 l = recv(fd_outer_socket_pair[0], pid, sizeof *pid, 0);
b0067625
ZJS		 4921 if (l < 0)
4922 return log_error_errno(errno, "Failed to read inner child PID: %m");
c6147113
LP		 4923 if (l != sizeof *pid)
4924 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
b0067625
ZJS		 4925
4926 /* We also retrieve container UUID in case it was generated by outer child */
af06cd30 4927 l = recv(fd_outer_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
b0067625
ZJS		 4928 if (l < 0)
4929 return log_error_errno(errno, "Failed to read container machine ID: %m");
c6147113
LP		 4930 if (l != sizeof(arg_uuid))
4931 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
b0067625
ZJS		 4932
4933 /* We also retrieve the socket used for notifications generated by outer child */
af06cd30 4934 notify_socket = receive_one_fd(fd_outer_socket_pair[0], 0);
b0067625
ZJS		 4935 if (notify_socket < 0)
4936 return log_error_errno(notify_socket,
4937 "Failed to receive notification socket from the outer child: %m");
4938
4939 log_debug("Init process invoked as PID "PID_FMT, *pid);
4940
4941 if (arg_userns_mode != USER_NAMESPACE_NO) {
c6147113
LP		 4942 if (!barrier_place_and_sync(&barrier)) /* #1 */
4943 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 4944
2f893044 4945 r = setup_uid_map(*pid, bind_user_uid, n_bind_user_uid);
b0067625
ZJS		 4946 if (r < 0)
4947 return r;
4948
4949 (void) barrier_place(&barrier); /* #2 */
4950 }
4951
4952 if (arg_private_network) {
75116558
PS		 4953 if (!arg_network_namespace_path) {
4954 /* Wait until the child has unshared its network namespace. */
c6147113
LP		 4955 if (!barrier_place_and_sync(&barrier)) /* #3 */
4956 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
75116558
PS		 4957 }
4958
5b4855ab
DDM		 4959 if (child_netns_fd < 0) {
4960 /* Make sure we have an open file descriptor to the child's network
4961 * namespace so it stays alive even if the child exits. */
4962 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
4963 if (r < 0)
4964 return log_error_errno(r, "Failed to open child network namespace: %m");
4965 }
4966
4967 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
b0067625
ZJS		 4968 if (r < 0)
4969 return r;
4970
4971 if (arg_network_veth) {
4972 r = setup_veth(arg_machine, *pid, veth_name,
4973 arg_network_bridge || arg_network_zone);
4974 if (r < 0)
4975 return r;
4976 else if (r > 0)
4977 ifi = r;
4978
4979 if (arg_network_bridge) {
4980 /* Add the interface to a bridge */
4981 r = setup_bridge(veth_name, arg_network_bridge, false);
4982 if (r < 0)
4983 return r;
4984 if (r > 0)
4985 ifi = r;
4986 } else if (arg_network_zone) {
4987 /* Add the interface to a bridge, possibly creating it */
4988 r = setup_bridge(veth_name, arg_network_zone, true);
4989 if (r < 0)
4990 return r;
4991 if (r > 0)
4992 ifi = r;
4993 }
4994 }
4995
4996 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
4997 if (r < 0)
4998 return r;
4999
5000 /* We created the primary and extra veth links now; let's remember this, so that we know to
5001 remove them later on. Note that we don't bother with removing veth links that were created
5002 here when their setup failed half-way, because in that case the kernel should be able to
5003 remove them on its own, since they cannot be referenced by anything yet. */
5004 *veth_created = true;
5005
5006 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
5007 if (r < 0)
5008 return r;
5009
5010 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
5011 if (r < 0)
5012 return r;
5013 }
5014
abdb9b08
LP		 5015 if (arg_register || !arg_keep_unit) {
5016 r = sd_bus_default_system(&bus);
5017 if (r < 0)
5018 return log_error_errno(r, "Failed to open system bus: %m");
e5a2d8b5
LP		 5019
5020 r = sd_bus_set_close_on_exit(bus, false);
5021 if (r < 0)
5022 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
abdb9b08
LP		 5023 }
5024
5025 if (!arg_keep_unit) {
5026 /* When a new scope is created for this container, then we'll be registered as its controller, in which
5027 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
5028 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
5029
75152a4d
LP		 5030 r = sd_bus_match_signal_async(
5031 bus,
5032 NULL,
5033 "org.freedesktop.systemd1",
5034 NULL,
5035 "org.freedesktop.systemd1.Scope",
5036 "RequestStop",
5037 on_request_stop, NULL, PID_TO_PTR(*pid));
abdb9b08 5038 if (r < 0)
75152a4d 5039 return log_error_errno(r, "Failed to request RequestStop match: %m");
abdb9b08
LP		 5040 }
5041
b0067625
ZJS		 5042 if (arg_register) {
5043 r = register_machine(
abdb9b08 5044 bus,
b0067625
ZJS		 5045 arg_machine,
5046 *pid,
5047 arg_directory,
5048 arg_uuid,
5049 ifi,
5050 arg_slice,
5051 arg_custom_mounts, arg_n_custom_mounts,
5052 arg_kill_signal,
5053 arg_property,
de40a303 5054 arg_property_message,
b0067625
ZJS		 5055 arg_keep_unit,
5056 arg_container_service_name);
5057 if (r < 0)
5058 return r;
abdb9b08 5059
cd2dfc6f
LP		 5060 } else if (!arg_keep_unit) {
5061 r = allocate_scope(
abdb9b08 5062 bus,
cd2dfc6f
LP		 5063 arg_machine,
5064 *pid,
5065 arg_slice,
5066 arg_custom_mounts, arg_n_custom_mounts,
5067 arg_kill_signal,
de40a303
LP		 5068 arg_property,
5069 arg_property_message);
cd2dfc6f
LP		 5070 if (r < 0)
5071 return r;
5072
5073 } else if (arg_slice || arg_property)
5074 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
b0067625 5075
27da7ef0 5076 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
b0067625
ZJS		 5077 if (r < 0)
5078 return r;
5079
27da7ef0 5080 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
720f0a2f
LP		 5081 if (r < 0)
5082 return r;
b0067625 5083
de54e02d 5084 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
b0067625
ZJS		 5085 if (r < 0)
5086 return r;
5087
5088 /* Notify the child that the parent is ready with all
5089 * its setup (including cgroup-ification), and that
5090 * the child can now hand over control to the code to
5091 * run inside the container. */
75116558 5092 (void) barrier_place(&barrier); /* #4 */
b0067625
ZJS		 5093
5094 /* Block SIGCHLD here, before notifying child.
5095 * process_pty() will handle it with the other signals. */
5096 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
5097
5098 /* Reset signal to default */
9c274488 5099 r = default_signals(SIGCHLD);
b0067625
ZJS		 5100 if (r < 0)
5101 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
5102
5103 r = sd_event_new(&event);
5104 if (r < 0)
5105 return log_error_errno(r, "Failed to get default event source: %m");
5106
8fd010bb
LP		 5107 (void) sd_event_set_watchdog(event, true);
5108
abdb9b08
LP		 5109 if (bus) {
5110 r = sd_bus_attach_event(bus, event, 0);
5111 if (r < 0)
5112 return log_error_errno(r, "Failed to attach bus to event loop: %m");
5113 }
5114
e96ceaba 5115 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
b0067625
ZJS		 5116 if (r < 0)
5117 return r;
5118
b71a0192
CB		 5119 if (arg_userns_mode != USER_NAMESPACE_NO) {
5120 r = wipe_fully_visible_fs(mntns_fd);
5121 if (r < 0)
5122 return r;
5123 mntns_fd = safe_close(mntns_fd);
5124 }
5125
b0067625 5126 /* Let the child know that we are ready and wait that the child is completely ready now. */
c6147113
LP		 5127 if (!barrier_place_and_sync(&barrier)) /* #5 */
5128 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 5129
38ccb557 5130 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
b0067625
ZJS		 5131 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
5132 etc_passwd_lock = safe_close(etc_passwd_lock);
5133
04f590a4
LP		 5134 (void) sd_notifyf(false,
5135 "STATUS=Container running.\n"
5136 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
4bf4f50f
ZJS		 5137 if (!arg_notify_ready) {
5138 r = sd_notify(false, "READY=1\n");
5139 if (r < 0)
5140 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
5141 }
b0067625
ZJS		 5142
5143 if (arg_kill_signal > 0) {
5144 /* Try to kill the init system on SIGINT or SIGTERM */
919f5ae0
LP		 5145 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
5146 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
b0067625
ZJS		 5147 } else {
5148 /* Immediately exit */
919f5ae0
LP		 5149 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
5150 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
b0067625
ZJS		 5151 }
5152
6916b164 5153 /* Exit when the child exits */
919f5ae0 5154 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
b0067625 5155
b07ee903
CB		 5156 /* Retrieve the kmsg fifo allocated by inner child */
5157 fd_kmsg_fifo = receive_one_fd(fd_inner_socket_pair[0], 0);
5158 if (fd_kmsg_fifo < 0)
5159 return log_error_errno(fd_kmsg_fifo, "Failed to receive kmsg fifo from inner child: %m");
5160
b0067625 5161 if (arg_expose_ports) {
b07ee903 5162 r = expose_port_watch_rtnl(event, fd_inner_socket_pair[0], on_address_change, expose_args, &rtnl);
b0067625
ZJS		 5163 if (r < 0)
5164 return r;
5165
deff68e7
FW		 5166 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5167 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5168 }
5169
3acc84eb
FB		 5170 if (arg_console_mode != CONSOLE_PIPE) {
5171 _cleanup_close_ int fd = -1;
5172 PTYForwardFlags flags = 0;
de40a303 5173
3acc84eb 5174 /* Retrieve the master pty allocated by inner child */
bb1aa185 5175 fd = receive_one_fd(fd_inner_socket_pair[0], 0);
3acc84eb
FB		 5176 if (fd < 0)
5177 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
5178
5179 switch (arg_console_mode) {
de40a303 5180
3acc84eb
FB		 5181 case CONSOLE_READ_ONLY:
5182 flags |= PTY_FORWARD_READ_ONLY;
5183
5184 _fallthrough_;
5185
5186 case CONSOLE_INTERACTIVE:
5187 flags |= PTY_FORWARD_IGNORE_VHANGUP;
5188
5189 r = pty_forward_new(event, fd, flags, &forward);
5190 if (r < 0)
5191 return log_error_errno(r, "Failed to create PTY forwarder: %m");
5192
f5fbe71d 5193 if (arg_console_width != UINT_MAX || arg_console_height != UINT_MAX)
3acc84eb
FB		 5194 (void) pty_forward_set_width_height(forward,
5195 arg_console_width,
5196 arg_console_height);
5197 break;
5198
5199 default:
5200 assert(arg_console_mode == CONSOLE_PASSIVE);
5201 }
5202
5203 *master = TAKE_FD(fd);
de40a303 5204 }
b0067625 5205
5d9d3fcb
CB		 5206 fd_inner_socket_pair[0] = safe_close(fd_inner_socket_pair[0]);
5207
b0067625
ZJS		 5208 r = sd_event_loop(event);
5209 if (r < 0)
5210 return log_error_errno(r, "Failed to run event loop: %m");
5211
de40a303
LP		 5212 if (forward) {
5213 char last_char = 0;
b0067625 5214
de40a303
LP		 5215 (void) pty_forward_get_last_char(forward, &last_char);
5216 forward = pty_forward_free(forward);
b0067625 5217
de40a303
LP		 5218 if (!arg_quiet && last_char != '\n')
5219 putc('\n', stdout);
5220 }
b0067625
ZJS		 5221
5222 /* Kill if it is not dead yet anyway */
0bb0a9fa
ZJS		 5223 if (!arg_register && !arg_keep_unit && bus)
5224 terminate_scope(bus, arg_machine);
b0067625
ZJS		 5225
5226 /* Normally redundant, but better safe than sorry */
c67b0082 5227 (void) kill(*pid, SIGKILL);
b0067625 5228
5d9d3fcb
CB		 5229 fd_kmsg_fifo = safe_close(fd_kmsg_fifo);
5230
5b4855ab
DDM		 5231 if (arg_private_network) {
5232 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
5233 * to avoid having to move the parent to the child network namespace. */
5234 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
5235 if (r < 0)
5236 return r;
5237
5238 if (r == 0) {
5239 _cleanup_close_ int parent_netns_fd = -1;
5240
5241 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
5242 if (r < 0) {
5243 log_error_errno(r, "Failed to open parent network namespace: %m");
5244 _exit(EXIT_FAILURE);
5245 }
5246
5247 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
5248 if (r < 0) {
5249 log_error_errno(r, "Failed to enter child network namespace: %m");
5250 _exit(EXIT_FAILURE);
5251 }
5252
5253 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
5254 if (r < 0)
5255 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
5256
5257 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
5258 }
5259 }
5260
8f03de53 5261 r = wait_for_container(TAKE_PID(*pid), &container_status);
b0067625 5262
0bb0a9fa
ZJS		 5263 /* Tell machined that we are gone. */
5264 if (bus)
5265 (void) unregister_machine(bus, arg_machine);
5266
b0067625
ZJS		 5267 if (r < 0)
5268 /* We failed to wait for the container, or the container exited abnormally. */
5269 return r;
5270 if (r > 0 || container_status == CONTAINER_TERMINATED) {
27e29a1e
ZJS		 5271 /* r > 0 → The container exited with a non-zero status.
5272 * As a special case, we need to replace 133 with a different value,
5273 * because 133 is special-cased in the service file to reboot the container.
5274 * otherwise → The container exited with zero status and a reboot was not requested.
5275 */
2a49b612 5276 if (r == EXIT_FORCE_RESTART)
27e29a1e 5277 r = EXIT_FAILURE; /* replace 133 with the general failure code */
b0067625 5278 *ret = r;
b0067625
ZJS		 5279 return 0; /* finito */
5280 }
5281
5282 /* CONTAINER_REBOOTED, loop again */
5283
5284 if (arg_keep_unit) {
5285 /* Special handling if we are running as a service: instead of simply
5286 * restarting the machine we want to restart the entire service, so let's
5287 * inform systemd about this with the special exit code 133. The service
5288 * file uses RestartForceExitStatus=133 so that this results in a full
5289 * nspawn restart. This is necessary since we might have cgroup parameters
5290 * set we want to have flushed out. */
2a49b612
ZJS		 5291 *ret = EXIT_FORCE_RESTART;
5292 return 0; /* finito */
b0067625
ZJS		 5293 }
5294
deff68e7
FW		 5295 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5296 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5297
5298 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5299 *veth_created = false;
5300 return 1; /* loop again */
5301}
5302
bf428efb 5303static int initialize_rlimits(void) {
852b6250 5304 /* The default resource limits the kernel passes to PID 1, as per kernel 5.16. Let's pass our container payload
bf428efb
LP		 5305 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
5306 * container execution environments. */
5307
5308 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
852b6250
LP		 5309 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
5310 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
5311 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
5312 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
5313 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
5314 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
5315 [RLIMIT_MEMLOCK] = { DEFAULT_RLIMIT_MEMLOCK, DEFAULT_RLIMIT_MEMLOCK },
5316 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
5317 [RLIMIT_NICE] = { 0, 0 },
5318 [RLIMIT_NOFILE] = { 1024, 4096 },
5319 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
5320 [RLIMIT_RTPRIO] = { 0, 0 },
5321 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
5322 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
bf428efb
LP		 5323
5324 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
5325 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
5326 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
5327 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
5328 * that PID 1 changes a number of other resource limits during early initialization which is why we
5329 * don't read the other limits from PID 1 but prefer the static table above. */
5330 };
5331
5332 int rl;
5333
5334 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
bf428efb
LP		 5335 /* Let's only fill in what the user hasn't explicitly configured anyway */
5336 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
5337 const struct rlimit *v;
5338 struct rlimit buffer;
5339
5340 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
5341 /* For these two let's read the limits off PID 1. See above for an explanation. */
5342
5343 if (prlimit(1, rl, NULL, &buffer) < 0)
5344 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
5345
dbf1aca6
LP		 5346 v = &buffer;
5347 } else if (rl == RLIMIT_NOFILE) {
5348 /* We nowadays bump RLIMIT_NOFILE's hard limit early in PID 1 for all
5349 * userspace. Given that nspawn containers are often run without our PID 1,
5350 * let's grant the containers a raised RLIMIT_NOFILE hard limit by default,
5351 * so that container userspace gets similar resources as host userspace
5352 * gets. */
5353 buffer = kernel_defaults[rl];
5354 buffer.rlim_max = MIN((rlim_t) read_nr_open(), (rlim_t) HIGH_RLIMIT_NOFILE);
bf428efb
LP		 5355 v = &buffer;
5356 } else
5357 v = kernel_defaults + rl;
5358
5359 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
5360 if (!arg_rlimit[rl])
5361 return log_oom();
5362 }
5363
5364 if (DEBUG_LOGGING) {
5365 _cleanup_free_ char *k = NULL;
5366
5367 (void) rlimit_format(arg_rlimit[rl], &k);
5368 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
5369 }
5370 }
5371
5372 return 0;
5373}
5374
287b7376 5375static int cant_be_in_netns(void) {
287b7376
LP		 5376 _cleanup_close_ int fd = -1;
5377 struct ucred ucred;
5378 int r;
5379
5380 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
5381 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
5382 * nice message. */
5383
5384 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
5385 return 0;
5386
5387 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
5388 if (fd < 0)
5389 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
5390
1861986a
LP		 5391 r = connect_unix_path(fd, AT_FDCWD, "/run/udev/control");
5392 if (r < 0) {
5393 if (r == -ENOENT || ERRNO_IS_DISCONNECT(r))
287b7376
LP		 5394 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5395 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
5396
1861986a 5397 return log_error_errno(r, "Failed to connect socket to udev control socket: %m");
287b7376
LP		 5398 }
5399
5400 r = getpeercred(fd, &ucred);
5401 if (r < 0)
5402 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
5403
f7a2dc3d 5404 r = in_same_namespace(ucred.pid, 0, NAMESPACE_NET);
287b7376 5405 if (r < 0)
f7a2dc3d
CB		 5406 return log_error_errno(r, "Failed to determine network namespace of udev: %m");
5407 if (r == 0)
287b7376
LP		 5408 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5409 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
5410 return 0;
5411}
5412
44dbef90 5413static int run(int argc, char *argv[]) {
7bf011e3
LP		 5414 bool secondary = false, remove_directory = false, remove_image = false,
5415 veth_created = false, remove_tmprootdir = false;
2d845785 5416 _cleanup_close_ int master = -1;
03cfe0d5 5417 _cleanup_fdset_free_ FDSet *fds = NULL;
2d845785 5418 int r, n_fd_passed, ret = EXIT_SUCCESS;
5aa3eba5 5419 char veth_name[IFNAMSIZ] = "";
761cf19d 5420 struct ExposeArgs expose_args = {};
8e766630 5421 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
c67b0082 5422 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
2d845785 5423 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
18b5886e 5424 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
761cf19d 5425 _cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
7bf011e3 5426 pid_t pid = 0;
03cfe0d5
LP		 5427
5428 log_parse_environment();
5429 log_open();
415fc41c 5430
03cfe0d5
LP		 5431 r = parse_argv(argc, argv);
5432 if (r <= 0)
5433 goto finish;
5434
38ee19c0
ZJS		 5435 if (geteuid() != 0) {
5436 r = log_warning_errno(SYNTHETIC_ERRNO(EPERM),
5437 argc >= 2 ? "Need to be root." :
5438 "Need to be root (and some arguments are usually required).\nHint: try --help");
03cfe0d5 5439 goto finish;
38ee19c0 5440 }
fba868fa 5441
287b7376
LP		 5442 r = cant_be_in_netns();
5443 if (r < 0)
5444 goto finish;
5445
bf428efb
LP		 5446 r = initialize_rlimits();
5447 if (r < 0)
5448 goto finish;
5449
de40a303
LP		 5450 r = load_oci_bundle();
5451 if (r < 0)
5452 goto finish;
5453
f757855e
LP		 5454 r = determine_names();
5455 if (r < 0)
5456 goto finish;
5457
5458 r = load_settings();
5459 if (r < 0)
5460 goto finish;
5461
d4d99bc6 5462 r = cg_unified();
5eee8290
LP		 5463 if (r < 0) {
5464 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
5465 goto finish;
5466 }
5467
f757855e
LP		 5468 r = verify_arguments();
5469 if (r < 0)
5470 goto finish;
03cfe0d5 5471
49048684
ZJS		 5472 /* Reapply environment settings. */
5473 (void) detect_unified_cgroup_hierarchy_from_environment();
8199d554 5474
2949ff26
LP		 5475 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
5476 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
5477 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
9c274488 5478 (void) ignore_signals(SIGPIPE);
2949ff26 5479
03cfe0d5
LP		 5480 n_fd_passed = sd_listen_fds(false);
5481 if (n_fd_passed > 0) {
5482 r = fdset_new_listen_fds(&fds, false);
5483 if (r < 0) {
5484 log_error_errno(r, "Failed to collect file descriptors: %m");
5485 goto finish;
5486 }
5487 }
5488
83e803a9
ZJS		 5489 /* The "default" umask. This is appropriate for most file and directory
5490 * operations performed by nspawn, and is the umask that will be used for
5491 * the child. Functions like copy_devnodes() change the umask temporarily. */
5492 umask(0022);
5493
03cfe0d5
LP		 5494 if (arg_directory) {
5495 assert(!arg_image);
5496
b35ca61a
LP		 5497 /* Safety precaution: let's not allow running images from the live host OS image, as long as
5498 * /var from the host will propagate into container dynamically (because bad things happen if
5499 * two systems write to the same /var). Let's allow it for the special cases where /var is
5500 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
5501 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
5502 log_error("Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
03cfe0d5
LP		 5503 r = -EINVAL;
5504 goto finish;
5505 }
5506
5507 if (arg_ephemeral) {
5508 _cleanup_free_ char *np = NULL;
5509
8d4aa2bb 5510 r = chase_symlinks_and_update(&arg_directory, 0);
3f342ec4
LP		 5511 if (r < 0)
5512 goto finish;
5513
7bf011e3
LP		 5514 /* If the specified path is a mount point we generate the new snapshot immediately
5515 * inside it under a random name. However if the specified is not a mount point we
5516 * create the new snapshot in the parent directory, just next to it. */
e1873695 5517 r = path_is_mount_point(arg_directory, NULL, 0);
03cfe0d5
LP		 5518 if (r < 0) {
5519 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5520 goto finish;
5521 }
5522 if (r > 0)
770b5ce4 5523 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 5524 else
770b5ce4 5525 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5 5526 if (r < 0) {
0f3be6ca 5527 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
03cfe0d5
LP		 5528 goto finish;
5529 }
5530
6992459c 5531 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
162392b7 5532 * only owned by us and no one else. */
6992459c 5533 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
03cfe0d5
LP		 5534 if (r < 0) {
5535 log_error_errno(r, "Failed to lock %s: %m", np);
5536 goto finish;
5537 }
5538
7bf011e3
LP		 5539 {
5540 BLOCK_SIGNALS(SIGINT);
5541 r = btrfs_subvol_snapshot(arg_directory, np,
5542 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5543 BTRFS_SNAPSHOT_FALLBACK_COPY |
5544 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5545 BTRFS_SNAPSHOT_RECURSIVE |
5546 BTRFS_SNAPSHOT_QUOTA |
5547 BTRFS_SNAPSHOT_SIGINT);
5548 }
5549 if (r == -EINTR) {
5550 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5551 goto finish;
5552 }
03cfe0d5
LP		 5553 if (r < 0) {
5554 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5555 goto finish;
ec16945e
LP		 5556 }
5557
1cc6c93a 5558 free_and_replace(arg_directory, np);
17cbb288 5559 remove_directory = true;
30535c16 5560 } else {
cb638b5e 5561 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
8d4aa2bb
LP		 5562 if (r < 0)
5563 goto finish;
5564
30535c16
LP		 5565 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5566 if (r == -EBUSY) {
5567 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5568 goto finish;
5569 }
5570 if (r < 0) {
5571 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
476b8254 5572 goto finish;
30535c16
LP		 5573 }
5574
5575 if (arg_template) {
8d4aa2bb 5576 r = chase_symlinks_and_update(&arg_template, 0);
3f342ec4
LP		 5577 if (r < 0)
5578 goto finish;
5579
7bf011e3
LP		 5580 {
5581 BLOCK_SIGNALS(SIGINT);
5582 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5583 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5584 BTRFS_SNAPSHOT_FALLBACK_COPY |
5585 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5586 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5587 BTRFS_SNAPSHOT_RECURSIVE |
5588 BTRFS_SNAPSHOT_QUOTA |
5589 BTRFS_SNAPSHOT_SIGINT);
5590 }
ff6c6cc1
LP		 5591 if (r == -EEXIST)
5592 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5593 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
7bf011e3
LP		 5594 else if (r == -EINTR) {
5595 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5596 goto finish;
5597 } else if (r < 0) {
83521414 5598 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16 5599 goto finish;
ff6c6cc1
LP		 5600 } else
5601 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5602 "Populated %s from template %s.", arg_directory, arg_template);
30535c16 5603 }
ec16945e
LP		 5604 }
5605
7732f92b 5606 if (arg_start_mode == START_BOOT) {
aff7ae0d 5607 _cleanup_free_ char *b = NULL;
a5201ed6 5608 const char *p;
c9fe05e0 5609
aff7ae0d
LP		 5610 if (arg_pivot_root_new) {
5611 b = path_join(arg_directory, arg_pivot_root_new);
5612 if (!b)
5613 return log_oom();
5614
5615 p = b;
5616 } else
a5201ed6 5617 p = arg_directory;
c9fe05e0
AR		 5618
5619 if (path_is_os_tree(p) <= 0) {
aff7ae0d
LP		 5620 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5621 "Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
1b9e5b12
LP		 5622 goto finish;
5623 }
5624 } else {
aff7ae0d 5625 _cleanup_free_ char *p = NULL;
c9fe05e0 5626
a5201ed6 5627 if (arg_pivot_root_new)
aff7ae0d 5628 p = path_join(arg_directory, arg_pivot_root_new, "/usr/");
a5201ed6 5629 else
aff7ae0d
LP		 5630 p = path_join(arg_directory, "/usr/");
5631 if (!p)
5632 return log_oom();
1b9e5b12 5633
aff7ae0d
LP		 5634 if (laccess(p, F_OK) < 0) {
5635 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5636 "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
1b9e5b12 5637 goto finish;
1b9e5b12
LP		 5638 }
5639 }
ec16945e 5640
6b9132a9 5641 } else {
d04faa4e 5642 DissectImageFlags dissect_image_flags =
4b5de5dd 5643 DISSECT_IMAGE_GENERIC_ROOT |
d04faa4e
LP		 5644 DISSECT_IMAGE_REQUIRE_ROOT |
5645 DISSECT_IMAGE_RELAX_VAR_CHECK |
73d88b80
LP		 5646 DISSECT_IMAGE_USR_NO_ROOT |
5647 DISSECT_IMAGE_ADD_PARTITION_DEVICES |
5648 DISSECT_IMAGE_PIN_PARTITION_DEVICES;
ec16945e
LP		 5649 assert(arg_image);
5650 assert(!arg_template);
5651
8d4aa2bb 5652 r = chase_symlinks_and_update(&arg_image, 0);
3f342ec4
LP		 5653 if (r < 0)
5654 goto finish;
5655
0f3be6ca
LP		 5656 if (arg_ephemeral) {
5657 _cleanup_free_ char *np = NULL;
5658
5659 r = tempfn_random(arg_image, "machine.", &np);
5660 if (r < 0) {
5661 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5662 goto finish;
5663 }
5664
6992459c
LP		 5665 /* Always take an exclusive lock on our own ephemeral copy. */
5666 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
0f3be6ca
LP		 5667 if (r < 0) {
5668 r = log_error_errno(r, "Failed to create image lock: %m");
5669 goto finish;
5670 }
5671
7bf011e3
LP		 5672 {
5673 BLOCK_SIGNALS(SIGINT);
5674 r = copy_file(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600, FS_NOCOW_FL, FS_NOCOW_FL, COPY_REFLINK|COPY_CRTIME|COPY_SIGINT);
5675 }
5676 if (r == -EINTR) {
5677 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5678 goto finish;
5679 }
0f3be6ca
LP		 5680 if (r < 0) {
5681 r = log_error_errno(r, "Failed to copy image file: %m");
5682 goto finish;
5683 }
5684
1cc6c93a 5685 free_and_replace(arg_image, np);
0f3be6ca
LP		 5686 remove_image = true;
5687 } else {
5688 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5689 if (r == -EBUSY) {
5690 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5691 goto finish;
5692 }
5693 if (r < 0) {
5694 r = log_error_errno(r, "Failed to create image lock: %m");
5695 goto finish;
5696 }
4623e8e6 5697
89e62e0b
LP		 5698 r = verity_settings_load(
5699 &arg_verity_settings,
5700 arg_image, NULL, NULL);
e7cbe5cb
LB		 5701 if (r < 0) {
5702 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5703 goto finish;
78ebe980 5704 }
89e62e0b
LP		 5705
5706 if (arg_verity_settings.data_path)
5707 dissect_image_flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
30535c16
LP		 5708 }
5709
c67b0082 5710 if (!mkdtemp(tmprootdir)) {
0f3be6ca 5711 r = log_error_errno(errno, "Failed to create temporary directory: %m");
6b9132a9 5712 goto finish;
1b9e5b12 5713 }
6b9132a9 5714
c67b0082
LP		 5715 remove_tmprootdir = true;
5716
5717 arg_directory = strdup(tmprootdir);
1b9e5b12
LP		 5718 if (!arg_directory) {
5719 r = log_oom();
5720 goto finish;
6b9132a9 5721 }
88213476 5722
89e62e0b
LP		 5723 r = loop_device_make_by_path(
5724 arg_image,
5725 arg_read_only ? O_RDONLY : O_RDWR,
5726 FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
7f52206a 5727 LOCK_SH,
89e62e0b 5728 &loop);
2d845785
LP		 5729 if (r < 0) {
5730 log_error_errno(r, "Failed to set up loopback block device: %m");
842f3b0f
LP		 5731 goto finish;
5732 }
1b9e5b12 5733
bad31660 5734 r = dissect_loop_device_and_warn(
bad31660 5735 loop,
89e62e0b 5736 &arg_verity_settings,
18d73705 5737 NULL,
e7cbe5cb 5738 dissect_image_flags,
e0f9e7bd 5739 &dissected_image);
2d845785 5740 if (r == -ENOPKG) {
4526113f 5741 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
2d845785
LP		 5742 log_notice("Note that the disk image needs to\n"
5743 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5744 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
db811444 5745 " c) or follow https://uapi-group.org/specifications/specs/discoverable_partitions_specification\n"
2d845785
LP		 5746 " d) or contain a file system without a partition table\n"
5747 "in order to be bootable with systemd-nspawn.");
1b9e5b12 5748 goto finish;
2d845785 5749 }
4526113f 5750 if (r < 0)
842f3b0f 5751 goto finish;
1b9e5b12 5752
88b3300f
LP		 5753 r = dissected_image_load_verity_sig_partition(
5754 dissected_image,
5755 loop->fd,
5756 &arg_verity_settings);
5757 if (r < 0)
5758 goto finish;
5759
8ee9615e
LP		 5760 if (dissected_image->has_verity && !arg_verity_settings.root_hash && !dissected_image->has_verity_sig)
5761 log_notice("Note: image %s contains verity information, but no root hash specified and no embedded "
5762 "root hash signature found! Proceeding without integrity checking.", arg_image);
4623e8e6 5763
89e62e0b
LP		 5764 r = dissected_image_decrypt_interactively(
5765 dissected_image,
5766 NULL,
5767 &arg_verity_settings,
e330f97a 5768 0);
1b9e5b12
LP		 5769 if (r < 0)
5770 goto finish;
0f3be6ca
LP		 5771
5772 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5773 if (remove_image && unlink(arg_image) >= 0)
5774 remove_image = false;
842f3b0f 5775 }
842f3b0f 5776
86c0dd4a 5777 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5a8af538
LP		 5778 if (r < 0)
5779 goto finish;
5780
de40a303
LP		 5781 if (arg_console_mode < 0)
5782 arg_console_mode =
5783 isatty(STDIN_FILENO) > 0 &&
5784 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
9c857b9d 5785
de40a303
LP		 5786 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5787 arg_quiet = true;
a258bf26 5788
9c857b9d 5789 if (!arg_quiet)
c85c2f79 5790 log_info("Spawning container %s on %s.\nPress Ctrl-] three times within 1s to kill container.",
9c857b9d
LP		 5791 arg_machine, arg_image ?: arg_directory);
5792
72c0a2c2 5793 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
a258bf26 5794
66edd963 5795 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
03cfe0d5
LP		 5796 r = log_error_errno(errno, "Failed to become subreaper: %m");
5797 goto finish;
5798 }
5799
761cf19d
FW		 5800 if (arg_expose_ports) {
5801 r = fw_ctx_new(&fw_ctx);
5802 if (r < 0) {
5803 log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
5804 goto finish;
5805 }
5806 expose_args.fw_ctx = fw_ctx;
5807 }
d87be9b0 5808 for (;;) {
3acc84eb 5809 r = run_container(dissected_image,
44dbef90
LP		 5810 secondary,
5811 fds,
5812 veth_name, &veth_created,
761cf19d 5813 &expose_args, &master,
44dbef90 5814 &pid, &ret);
b0067625 5815 if (r <= 0)
d87be9b0 5816 break;
d87be9b0 5817 }
88213476
LP		 5818
5819finish:
04f590a4
LP		 5820 (void) sd_notify(false,
5821 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5822 "STOPPING=1\nSTATUS=Terminating...");
af4ec430 5823
9444b1f2 5824 if (pid > 0)
c67b0082 5825 (void) kill(pid, SIGKILL);
88213476 5826
503546da 5827 /* Try to flush whatever is still queued in the pty */
6a0f896b 5828 if (master >= 0) {
f5fbe71d 5829 (void) copy_bytes(master, STDOUT_FILENO, UINT64_MAX, 0);
6a0f896b
LP		 5830 master = safe_close(master);
5831 }
5832
5833 if (pid > 0)
5834 (void) wait_for_terminate(pid, NULL);
503546da 5835
50ebcf6c
LP		 5836 pager_close();
5837
17cbb288 5838 if (remove_directory && arg_directory) {
ec16945e
LP		 5839 int k;
5840
17cbb288 5841 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
ec16945e 5842 if (k < 0)
17cbb288 5843 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
ec16945e
LP		 5844 }
5845
0f3be6ca
LP		 5846 if (remove_image && arg_image) {
5847 if (unlink(arg_image) < 0)
5848 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5849 }
5850
c67b0082
LP		 5851 if (remove_tmprootdir) {
5852 if (rmdir(tmprootdir) < 0)
5853 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5854 }
5855
785890ac
LP		 5856 if (arg_machine) {
5857 const char *p;
5858
63c372cb 5859 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 5860 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 5861 }
5862
deff68e7
FW		 5863 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET, &expose_args.address4);
5864 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET6, &expose_args.address6);
7513c5b8
LP		 5865
5866 if (veth_created)
5867 (void) remove_veth_links(veth_name, arg_network_veth_extra);
22b28dfd 5868 (void) remove_bridge(arg_network_zone);
f757855e 5869
f757855e
LP		 5870 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5871 expose_port_free_all(arg_expose_ports);
bf428efb 5872 rlimit_free_all(arg_rlimit);
b2645747 5873 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
3652872a 5874 credential_free_all(arg_credentials, arg_n_credentials);
6d0b55c2 5875
44dbef90
LP		 5876 if (r < 0)
5877 return r;
5878
5879 return ret;
88213476 5880}
44dbef90
LP		 5881
5882DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.