]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/machine/machine.c
machine: make machine_start_scope() static
[thirdparty/systemd.git] / src / machine / machine.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include <errno.h>
4 #include <unistd.h>
5 #include <sys/stat.h>
6
7 #include "sd-messages.h"
8
9 #include "alloc-util.h"
10 #include "bus-error.h"
11 #include "bus-util.h"
12 #include "env-file.h"
13 #include "errno-util.h"
14 #include "escape.h"
15 #include "extract-word.h"
16 #include "fd-util.h"
17 #include "fileio.h"
18 #include "format-util.h"
19 #include "hashmap.h"
20 #include "machine-dbus.h"
21 #include "machine.h"
22 #include "mkdir.h"
23 #include "parse-util.h"
24 #include "path-util.h"
25 #include "process-util.h"
26 #include "serialize.h"
27 #include "special.h"
28 #include "stdio-util.h"
29 #include "string-table.h"
30 #include "terminal-util.h"
31 #include "tmpfile-util.h"
32 #include "unit-name.h"
33 #include "user-util.h"
34 #include "util.h"
35
36 Machine* machine_new(Manager *manager, MachineClass class, const char *name) {
37 Machine *m;
38
39 assert(manager);
40 assert(class < _MACHINE_CLASS_MAX);
41 assert(name);
42
43 /* Passing class == _MACHINE_CLASS_INVALID here is fine. It
44 * means as much as "we don't know yet", and that we'll figure
45 * it out later when loading the state file. */
46
47 m = new0(Machine, 1);
48 if (!m)
49 return NULL;
50
51 m->name = strdup(name);
52 if (!m->name)
53 goto fail;
54
55 if (class != MACHINE_HOST) {
56 m->state_file = path_join("/run/systemd/machines", m->name);
57 if (!m->state_file)
58 goto fail;
59 }
60
61 m->class = class;
62
63 if (hashmap_put(manager->machines, m->name, m) < 0)
64 goto fail;
65
66 m->manager = manager;
67
68 return m;
69
70 fail:
71 free(m->state_file);
72 free(m->name);
73 return mfree(m);
74 }
75
76 Machine* machine_free(Machine *m) {
77 if (!m)
78 return NULL;
79
80 while (m->operations)
81 operation_free(m->operations);
82
83 if (m->in_gc_queue)
84 LIST_REMOVE(gc_queue, m->manager->machine_gc_queue, m);
85
86 machine_release_unit(m);
87
88 free(m->scope_job);
89
90 (void) hashmap_remove(m->manager->machines, m->name);
91
92 if (m->manager->host_machine == m)
93 m->manager->host_machine = NULL;
94
95 if (m->leader > 0)
96 (void) hashmap_remove_value(m->manager->machine_leaders, PID_TO_PTR(m->leader), m);
97
98 sd_bus_message_unref(m->create_message);
99
100 free(m->name);
101 free(m->state_file);
102 free(m->service);
103 free(m->root_directory);
104 free(m->netif);
105 return mfree(m);
106 }
107
108 int machine_save(Machine *m) {
109 _cleanup_free_ char *temp_path = NULL;
110 _cleanup_fclose_ FILE *f = NULL;
111 int r;
112
113 assert(m);
114
115 if (!m->state_file)
116 return 0;
117
118 if (!m->started)
119 return 0;
120
121 r = mkdir_safe_label("/run/systemd/machines", 0755, 0, 0, MKDIR_WARN_MODE);
122 if (r < 0)
123 goto fail;
124
125 r = fopen_temporary(m->state_file, &f, &temp_path);
126 if (r < 0)
127 goto fail;
128
129 (void) fchmod(fileno(f), 0644);
130
131 fprintf(f,
132 "# This is private data. Do not parse.\n"
133 "NAME=%s\n",
134 m->name);
135
136 if (m->unit) {
137 _cleanup_free_ char *escaped;
138
139 escaped = cescape(m->unit);
140 if (!escaped) {
141 r = -ENOMEM;
142 goto fail;
143 }
144
145 fprintf(f, "SCOPE=%s\n", escaped); /* We continue to call this "SCOPE=" because it is internal only, and we want to stay compatible with old files */
146 }
147
148 if (m->scope_job)
149 fprintf(f, "SCOPE_JOB=%s\n", m->scope_job);
150
151 if (m->service) {
152 _cleanup_free_ char *escaped;
153
154 escaped = cescape(m->service);
155 if (!escaped) {
156 r = -ENOMEM;
157 goto fail;
158 }
159 fprintf(f, "SERVICE=%s\n", escaped);
160 }
161
162 if (m->root_directory) {
163 _cleanup_free_ char *escaped;
164
165 escaped = cescape(m->root_directory);
166 if (!escaped) {
167 r = -ENOMEM;
168 goto fail;
169 }
170 fprintf(f, "ROOT=%s\n", escaped);
171 }
172
173 if (!sd_id128_is_null(m->id))
174 fprintf(f, "ID=" SD_ID128_FORMAT_STR "\n", SD_ID128_FORMAT_VAL(m->id));
175
176 if (m->leader != 0)
177 fprintf(f, "LEADER="PID_FMT"\n", m->leader);
178
179 if (m->class != _MACHINE_CLASS_INVALID)
180 fprintf(f, "CLASS=%s\n", machine_class_to_string(m->class));
181
182 if (dual_timestamp_is_set(&m->timestamp))
183 fprintf(f,
184 "REALTIME="USEC_FMT"\n"
185 "MONOTONIC="USEC_FMT"\n",
186 m->timestamp.realtime,
187 m->timestamp.monotonic);
188
189 if (m->n_netif > 0) {
190 size_t i;
191
192 fputs("NETIF=", f);
193
194 for (i = 0; i < m->n_netif; i++) {
195 if (i != 0)
196 fputc(' ', f);
197
198 fprintf(f, "%i", m->netif[i]);
199 }
200
201 fputc('\n', f);
202 }
203
204 r = fflush_and_check(f);
205 if (r < 0)
206 goto fail;
207
208 if (rename(temp_path, m->state_file) < 0) {
209 r = -errno;
210 goto fail;
211 }
212
213 if (m->unit) {
214 char *sl;
215
216 /* Create a symlink from the unit name to the machine
217 * name, so that we can quickly find the machine for
218 * each given unit. Ignore error. */
219 sl = strjoina("/run/systemd/machines/unit:", m->unit);
220 (void) symlink(m->name, sl);
221 }
222
223 return 0;
224
225 fail:
226 (void) unlink(m->state_file);
227
228 if (temp_path)
229 (void) unlink(temp_path);
230
231 return log_error_errno(r, "Failed to save machine data %s: %m", m->state_file);
232 }
233
234 static void machine_unlink(Machine *m) {
235 assert(m);
236
237 if (m->unit) {
238 char *sl;
239
240 sl = strjoina("/run/systemd/machines/unit:", m->unit);
241 (void) unlink(sl);
242 }
243
244 if (m->state_file)
245 (void) unlink(m->state_file);
246 }
247
248 int machine_load(Machine *m) {
249 _cleanup_free_ char *realtime = NULL, *monotonic = NULL, *id = NULL, *leader = NULL, *class = NULL, *netif = NULL;
250 int r;
251
252 assert(m);
253
254 if (!m->state_file)
255 return 0;
256
257 r = parse_env_file(NULL, m->state_file,
258 "SCOPE", &m->unit,
259 "SCOPE_JOB", &m->scope_job,
260 "SERVICE", &m->service,
261 "ROOT", &m->root_directory,
262 "ID", &id,
263 "LEADER", &leader,
264 "CLASS", &class,
265 "REALTIME", &realtime,
266 "MONOTONIC", &monotonic,
267 "NETIF", &netif);
268 if (r < 0) {
269 if (r == -ENOENT)
270 return 0;
271
272 return log_error_errno(r, "Failed to read %s: %m", m->state_file);
273 }
274
275 if (id)
276 sd_id128_from_string(id, &m->id);
277
278 if (leader)
279 parse_pid(leader, &m->leader);
280
281 if (class) {
282 MachineClass c;
283
284 c = machine_class_from_string(class);
285 if (c >= 0)
286 m->class = c;
287 }
288
289 if (realtime)
290 (void) deserialize_usec(realtime, &m->timestamp.realtime);
291 if (monotonic)
292 (void) deserialize_usec(monotonic, &m->timestamp.monotonic);
293
294 if (netif) {
295 size_t allocated = 0, nr = 0;
296 const char *p;
297 int *ni = NULL;
298
299 p = netif;
300 for (;;) {
301 _cleanup_free_ char *word = NULL;
302 int ifi;
303
304 r = extract_first_word(&p, &word, NULL, 0);
305 if (r == 0)
306 break;
307 if (r == -ENOMEM)
308 return log_oom();
309 if (r < 0) {
310 log_warning_errno(r, "Failed to parse NETIF: %s", netif);
311 break;
312 }
313
314 if (parse_ifindex(word, &ifi) < 0)
315 continue;
316
317 if (!GREEDY_REALLOC(ni, allocated, nr+1)) {
318 free(ni);
319 return log_oom();
320 }
321
322 ni[nr++] = ifi;
323 }
324
325 free(m->netif);
326 m->netif = ni;
327 m->n_netif = nr;
328 }
329
330 return r;
331 }
332
333 static int machine_start_scope(
334 Manager *manager,
335 const char *scope,
336 pid_t pid,
337 const char *slice,
338 const char *description,
339 sd_bus_message *more_properties,
340 sd_bus_error *error,
341 char **job) {
342
343 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL, *reply = NULL;
344 int r;
345
346 assert(manager);
347 assert(scope);
348 assert(pid > 1);
349
350 r = sd_bus_message_new_method_call(
351 manager->bus,
352 &m,
353 "org.freedesktop.systemd1",
354 "/org/freedesktop/systemd1",
355 "org.freedesktop.systemd1.Manager",
356 "StartTransientUnit");
357 if (r < 0)
358 return r;
359
360 r = sd_bus_message_append(m, "ss", strempty(scope), "fail");
361 if (r < 0)
362 return r;
363
364 r = sd_bus_message_open_container(m, 'a', "(sv)");
365 if (r < 0)
366 return r;
367
368 if (!isempty(slice)) {
369 r = sd_bus_message_append(m, "(sv)", "Slice", "s", slice);
370 if (r < 0)
371 return r;
372 }
373
374 if (!isempty(description)) {
375 r = sd_bus_message_append(m, "(sv)", "Description", "s", description);
376 if (r < 0)
377 return r;
378 }
379
380 r = sd_bus_message_append(m, "(sv)(sv)(sv)(sv)(sv)",
381 "PIDs", "au", 1, pid,
382 "Delegate", "b", 1,
383 "CollectMode", "s", "inactive-or-failed",
384 "AddRef", "b", 1,
385 "TasksMax", "t", UINT64_C(16384));
386 if (r < 0)
387 return r;
388
389 if (more_properties) {
390 r = sd_bus_message_copy(m, more_properties, true);
391 if (r < 0)
392 return r;
393 }
394
395 r = sd_bus_message_close_container(m);
396 if (r < 0)
397 return r;
398
399 r = sd_bus_message_append(m, "a(sa(sv))", 0);
400 if (r < 0)
401 return r;
402
403 r = sd_bus_call(manager->bus, m, 0, error, &reply);
404 if (r < 0)
405 return r;
406
407 if (job) {
408 const char *j;
409 char *copy;
410
411 r = sd_bus_message_read(reply, "o", &j);
412 if (r < 0)
413 return r;
414
415 copy = strdup(j);
416 if (!copy)
417 return -ENOMEM;
418
419 *job = copy;
420 }
421
422 return 1;
423 }
424
425 static int machine_ensure_scope(Machine *m, sd_bus_message *properties, sd_bus_error *error) {
426 assert(m);
427 assert(m->class != MACHINE_HOST);
428
429 if (!m->unit) {
430 _cleanup_free_ char *escaped = NULL, *scope = NULL;
431 char *description, *job = NULL;
432 int r;
433
434 escaped = unit_name_escape(m->name);
435 if (!escaped)
436 return log_oom();
437
438 scope = strjoin("machine-", escaped, ".scope");
439 if (!scope)
440 return log_oom();
441
442 description = strjoina(m->class == MACHINE_VM ? "Virtual Machine " : "Container ", m->name);
443
444 r = machine_start_scope(m->manager, scope, m->leader, SPECIAL_MACHINE_SLICE, description, properties, error, &job);
445 if (r < 0)
446 return log_error_errno(r, "Failed to start machine scope: %s", bus_error_message(error, r));
447
448 m->unit = TAKE_PTR(scope);
449 m->referenced = true;
450 free_and_replace(m->scope_job, job);
451 }
452
453 if (m->unit)
454 hashmap_put(m->manager->machine_units, m->unit, m);
455
456 return 0;
457 }
458
459 int machine_start(Machine *m, sd_bus_message *properties, sd_bus_error *error) {
460 int r;
461
462 assert(m);
463
464 if (!IN_SET(m->class, MACHINE_CONTAINER, MACHINE_VM))
465 return -EOPNOTSUPP;
466
467 if (m->started)
468 return 0;
469
470 r = hashmap_put(m->manager->machine_leaders, PID_TO_PTR(m->leader), m);
471 if (r < 0)
472 return r;
473
474 /* Create cgroup */
475 r = machine_ensure_scope(m, properties, error);
476 if (r < 0)
477 return r;
478
479 log_struct(LOG_INFO,
480 "MESSAGE_ID=" SD_MESSAGE_MACHINE_START_STR,
481 "NAME=%s", m->name,
482 "LEADER="PID_FMT, m->leader,
483 LOG_MESSAGE("New machine %s.", m->name));
484
485 if (!dual_timestamp_is_set(&m->timestamp))
486 dual_timestamp_get(&m->timestamp);
487
488 m->started = true;
489
490 /* Save new machine data */
491 machine_save(m);
492
493 machine_send_signal(m, true);
494 (void) manager_enqueue_nscd_cache_flush(m->manager);
495
496 return 0;
497 }
498
499 static int machine_stop_scope(Machine *m) {
500 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
501 char *job = NULL;
502 int r, q;
503
504 assert(m);
505 assert(m->class != MACHINE_HOST);
506
507 if (!m->unit)
508 return 0;
509
510 r = manager_stop_unit(m->manager, m->unit, &error, &job);
511 if (r < 0) {
512 log_error_errno(r, "Failed to stop machine scope: %s", bus_error_message(&error, r));
513 sd_bus_error_free(&error);
514 } else
515 free_and_replace(m->scope_job, job);
516
517 if (m->referenced) {
518 q = manager_unref_unit(m->manager, m->unit, &error);
519 if (q < 0)
520 log_warning_errno(q, "Failed to drop reference to machine scope, ignoring: %s", bus_error_message(&error, r));
521 m->referenced = false;
522 }
523
524 return r;
525 }
526
527 int machine_stop(Machine *m) {
528 int r;
529 assert(m);
530
531 if (!IN_SET(m->class, MACHINE_CONTAINER, MACHINE_VM))
532 return -EOPNOTSUPP;
533
534 r = machine_stop_scope(m);
535
536 m->stopping = true;
537
538 machine_save(m);
539 (void) manager_enqueue_nscd_cache_flush(m->manager);
540
541 return r;
542 }
543
544 int machine_finalize(Machine *m) {
545 assert(m);
546
547 if (m->started) {
548 log_struct(LOG_INFO,
549 "MESSAGE_ID=" SD_MESSAGE_MACHINE_STOP_STR,
550 "NAME=%s", m->name,
551 "LEADER="PID_FMT, m->leader,
552 LOG_MESSAGE("Machine %s terminated.", m->name));
553
554 m->stopping = true; /* The machine is supposed to be going away. Don't try to kill it. */
555 }
556
557 machine_unlink(m);
558 machine_add_to_gc_queue(m);
559
560 if (m->started) {
561 machine_send_signal(m, false);
562 m->started = false;
563 }
564
565 return 0;
566 }
567
568 bool machine_may_gc(Machine *m, bool drop_not_started) {
569 assert(m);
570
571 if (m->class == MACHINE_HOST)
572 return false;
573
574 if (drop_not_started && !m->started)
575 return true;
576
577 if (m->scope_job && manager_job_is_active(m->manager, m->scope_job))
578 return false;
579
580 if (m->unit && manager_unit_is_active(m->manager, m->unit))
581 return false;
582
583 return true;
584 }
585
586 void machine_add_to_gc_queue(Machine *m) {
587 assert(m);
588
589 if (m->in_gc_queue)
590 return;
591
592 LIST_PREPEND(gc_queue, m->manager->machine_gc_queue, m);
593 m->in_gc_queue = true;
594 }
595
596 MachineState machine_get_state(Machine *s) {
597 assert(s);
598
599 if (s->class == MACHINE_HOST)
600 return MACHINE_RUNNING;
601
602 if (s->stopping)
603 return MACHINE_CLOSING;
604
605 if (s->scope_job)
606 return MACHINE_OPENING;
607
608 return MACHINE_RUNNING;
609 }
610
611 int machine_kill(Machine *m, KillWho who, int signo) {
612 assert(m);
613
614 if (!IN_SET(m->class, MACHINE_VM, MACHINE_CONTAINER))
615 return -EOPNOTSUPP;
616
617 if (!m->unit)
618 return -ESRCH;
619
620 if (who == KILL_LEADER) {
621 /* If we shall simply kill the leader, do so directly */
622
623 if (kill(m->leader, signo) < 0)
624 return -errno;
625
626 return 0;
627 }
628
629 /* Otherwise, make PID 1 do it for us, for the entire cgroup */
630 return manager_kill_unit(m->manager, m->unit, signo, NULL);
631 }
632
633 int machine_openpt(Machine *m, int flags, char **ret_slave) {
634 assert(m);
635
636 switch (m->class) {
637
638 case MACHINE_HOST:
639
640 return openpt_allocate(flags, ret_slave);
641
642 case MACHINE_CONTAINER:
643 if (m->leader <= 0)
644 return -EINVAL;
645
646 return openpt_allocate_in_namespace(m->leader, flags, ret_slave);
647
648 default:
649 return -EOPNOTSUPP;
650 }
651 }
652
653 int machine_open_terminal(Machine *m, const char *path, int mode) {
654 assert(m);
655
656 switch (m->class) {
657
658 case MACHINE_HOST:
659 return open_terminal(path, mode);
660
661 case MACHINE_CONTAINER:
662 if (m->leader <= 0)
663 return -EINVAL;
664
665 return open_terminal_in_namespace(m->leader, path, mode);
666
667 default:
668 return -EOPNOTSUPP;
669 }
670 }
671
672 void machine_release_unit(Machine *m) {
673 assert(m);
674
675 if (!m->unit)
676 return;
677
678 (void) hashmap_remove(m->manager->machine_units, m->unit);
679 m->unit = mfree(m->unit);
680 }
681
682 int machine_get_uid_shift(Machine *m, uid_t *ret) {
683 char p[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(pid_t) + 1];
684 uid_t uid_base, uid_shift, uid_range;
685 gid_t gid_base, gid_shift, gid_range;
686 _cleanup_fclose_ FILE *f = NULL;
687 int k, r;
688
689 assert(m);
690 assert(ret);
691
692 /* Return the base UID/GID of the specified machine. Note that this only works for containers with simple
693 * mappings. In most cases setups should be simple like this, and administrators should only care about the
694 * basic offset a container has relative to the host. This is what this function exposes.
695 *
696 * If we encounter any more complex mappings we politely refuse this with ENXIO. */
697
698 if (m->class == MACHINE_HOST) {
699 *ret = 0;
700 return 0;
701 }
702
703 if (m->class != MACHINE_CONTAINER)
704 return -EOPNOTSUPP;
705
706 xsprintf(p, "/proc/" PID_FMT "/uid_map", m->leader);
707 f = fopen(p, "re");
708 if (!f) {
709 if (errno == ENOENT) {
710 /* If the file doesn't exist, user namespacing is off in the kernel, return a zero mapping hence. */
711 *ret = 0;
712 return 0;
713 }
714
715 return -errno;
716 }
717
718 /* Read the first line. There's at least one. */
719 errno = 0;
720 k = fscanf(f, UID_FMT " " UID_FMT " " UID_FMT "\n", &uid_base, &uid_shift, &uid_range);
721 if (k != 3) {
722 if (ferror(f))
723 return errno_or_else(EIO);
724
725 return -EBADMSG;
726 }
727
728 /* Not a mapping starting at 0? Then it's a complex mapping we can't expose here. */
729 if (uid_base != 0)
730 return -ENXIO;
731 /* Insist that at least the nobody user is mapped, everything else is weird, and hence complex, and we don't support it */
732 if (uid_range < UID_NOBODY)
733 return -ENXIO;
734
735 /* If there's more than one line, then we don't support this mapping. */
736 r = safe_fgetc(f, NULL);
737 if (r < 0)
738 return r;
739 if (r != 0) /* Insist on EOF */
740 return -ENXIO;
741
742 fclose(f);
743
744 xsprintf(p, "/proc/" PID_FMT "/gid_map", m->leader);
745 f = fopen(p, "re");
746 if (!f)
747 return -errno;
748
749 /* Read the first line. There's at least one. */
750 errno = 0;
751 k = fscanf(f, GID_FMT " " GID_FMT " " GID_FMT "\n", &gid_base, &gid_shift, &gid_range);
752 if (k != 3) {
753 if (ferror(f))
754 return errno_or_else(EIO);
755
756 return -EBADMSG;
757 }
758
759 /* If there's more than one line, then we don't support this file. */
760 r = safe_fgetc(f, NULL);
761 if (r < 0)
762 return r;
763 if (r != 0) /* Insist on EOF */
764 return -ENXIO;
765
766 /* If the UID and GID mapping doesn't match, we don't support this mapping. */
767 if (uid_base != (uid_t) gid_base)
768 return -ENXIO;
769 if (uid_shift != (uid_t) gid_shift)
770 return -ENXIO;
771 if (uid_range != (uid_t) gid_range)
772 return -ENXIO;
773
774 *ret = uid_shift;
775 return 0;
776 }
777
778 static const char* const machine_class_table[_MACHINE_CLASS_MAX] = {
779 [MACHINE_CONTAINER] = "container",
780 [MACHINE_VM] = "vm",
781 [MACHINE_HOST] = "host",
782 };
783
784 DEFINE_STRING_TABLE_LOOKUP(machine_class, MachineClass);
785
786 static const char* const machine_state_table[_MACHINE_STATE_MAX] = {
787 [MACHINE_OPENING] = "opening",
788 [MACHINE_RUNNING] = "running",
789 [MACHINE_CLOSING] = "closing"
790 };
791
792 DEFINE_STRING_TABLE_LOOKUP(machine_state, MachineState);
793
794 static const char* const kill_who_table[_KILL_WHO_MAX] = {
795 [KILL_LEADER] = "leader",
796 [KILL_ALL] = "all"
797 };
798
799 DEFINE_STRING_TABLE_LOOKUP(kill_who, KillWho);