[thirdparty/systemd.git] / src / home / homework-directory.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <sys/mount.h>

#include "btrfs-util.h"
#include "fd-util.h"
#include "homework-directory.h"
#include "homework-quota.h"
#include "mkdir.h"
#include "mount-util.h"
#include "path-util.h"
#include "rm-rf.h"
#include "tmpfile-util.h"
#include "umask-util.h"

int home_setup_directory(UserRecord *h, HomeSetup *setup) {
        assert(h);
        assert(setup);

        setup->root_fd = open(user_record_image_path(h), O_RDONLY|O_CLOEXEC|O_DIRECTORY);
        if (setup->root_fd < 0)
                return log_error_errno(errno, "Failed to open home directory: %m");

        return 0;
}

int home_activate_directory(
                UserRecord *h,
                HomeSetup *setup,
                PasswordCache *cache,
                UserRecord **ret_home) {

        _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *header_home = NULL;
        const char *hdo, *hd, *ipo, *ip;
        int r;

        assert(h);
        assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
        assert(setup);
        assert(ret_home);

        assert_se(ipo = user_record_image_path(h));
        ip = strdupa_safe(ipo); /* copy out, since reconciliation might cause changing of the field */

        assert_se(hdo = user_record_home_directory(h));
        hd = strdupa_safe(hdo);

        r = home_setup(h, 0, cache, setup, &header_home);
        if (r < 0)
                return r;

        r = home_refresh(h, setup, header_home, cache, NULL, &new_home);
        if (r < 0)
                return r;

        r = home_extend_embedded_identity(new_home, h, setup);
        if (r < 0)
                return r;

        setup->root_fd = safe_close(setup->root_fd);

        /* Create mount point to mount over if necessary */
        if (!path_equal(ip, hd))
                (void) mkdir_p(hd, 0700);

        /* Create a mount point (even if the directory is already placed correctly), as a way to indicate
         * this mount point is now "activated". Moreover, we want to set per-user
         * MS_NOSUID/MS_NOEXEC/MS_NODEV. */
        r = mount_nofollow_verbose(LOG_ERR, ip, hd, NULL, MS_BIND, NULL);
        if (r < 0)
                return r;

        r = mount_nofollow_verbose(LOG_ERR, NULL, hd, NULL, MS_BIND|MS_REMOUNT|user_record_mount_flags(h), NULL);
        if (r < 0) {
                (void) umount_verbose(LOG_ERR, hd, UMOUNT_NOFOLLOW);
                return r;
        }

        setup->do_drop_caches = false;

        log_info("Everything completed.");

        *ret_home = TAKE_PTR(new_home);
        return 0;
}

int home_create_directory_or_subvolume(UserRecord *h, HomeSetup *setup, UserRecord **ret_home) {
        _cleanup_(rm_rf_subvolume_and_freep) char *temporary = NULL;
        _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
        _cleanup_free_ char *d = NULL;
        const char *ip;
        int r;

        assert(h);
        assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME));
        assert(setup);
        assert(ret_home);

        assert_se(ip = user_record_image_path(h));

        r = tempfn_random(ip, "homework", &d);
        if (r < 0)
                return log_error_errno(r, "Failed to allocate temporary directory: %m");

        (void) mkdir_parents(d, 0755);

        switch (user_record_storage(h)) {

        case USER_SUBVOLUME:
                RUN_WITH_UMASK(0077)
                        r = btrfs_subvol_make(d);

                if (r >= 0) {
                        log_info("Subvolume created.");

                        if (h->disk_size != UINT64_MAX) {

                                /* Enable quota for the subvolume we just created. Note we don't check for
                                 * errors here and only log about debug level about this. */
                                r = btrfs_quota_enable(d, true);
                                if (r < 0)
                                        log_debug_errno(r, "Failed to enable quota on %s, ignoring: %m", d);

                                r = btrfs_subvol_auto_qgroup(d, 0, false);
                                if (r < 0)
                                        log_debug_errno(r, "Failed to set up automatic quota group on %s, ignoring: %m", d);

                                /* Actually configure the quota. We also ignore errors here, but we do log
                                 * about them loudly, to keep things discoverable even though we don't
                                 * consider lacking quota support in kernel fatal. */
                                (void) home_update_quota_btrfs(h, d);
                        }

                        break;
                }
                if (r != -ENOTTY)
                        return log_error_errno(r, "Failed to create temporary home directory subvolume %s: %m", d);

                log_info("Creating subvolume %s is not supported, as file system does not support subvolumes. Falling back to regular directory.", d);
                _fallthrough_;

        case USER_DIRECTORY:

                if (mkdir(d, 0700) < 0)
                        return log_error_errno(errno, "Failed to create temporary home directory %s: %m", d);

                (void) home_update_quota_classic(h, d);
                break;

        default:
                assert_not_reached();
        }

        temporary = TAKE_PTR(d); /* Needs to be destroyed now */

        setup->root_fd = open(temporary, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
        if (setup->root_fd < 0)
                return log_error_errno(errno, "Failed to open temporary home directory: %m");

        r = home_populate(h, setup->root_fd);
        if (r < 0)
                return r;

        r = home_sync_and_statfs(setup->root_fd, NULL);
        if (r < 0)
                return r;

        r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, &new_home);
        if (r < 0)
                return log_error_errno(r, "Failed to clone record: %m");

        r = user_record_add_binding(
                        new_home,
                        user_record_storage(h),
                        ip,
                        SD_ID128_NULL,
                        SD_ID128_NULL,
                        SD_ID128_NULL,
                        NULL,
                        NULL,
                        UINT64_MAX,
                        NULL,
                        NULL,
                        h->uid,
                        (gid_t) h->uid);
        if (r < 0)
                return log_error_errno(r, "Failed to add binding to record: %m");

        if (rename(temporary, ip) < 0)
                return log_error_errno(errno, "Failed to rename %s to %s: %m", temporary, ip);

        temporary = mfree(temporary);

        log_info("Everything completed.");

        *ret_home = TAKE_PTR(new_home);
        return 0;
}

int home_resize_directory(
                UserRecord *h,
                HomeSetupFlags flags,
                PasswordCache *cache,
                HomeSetup *setup,
                UserRecord **ret_home) {

        _cleanup_(user_record_unrefp) UserRecord *embedded_home = NULL, *new_home = NULL;
        int r;

        assert(h);
        assert(setup);
        assert(ret_home);
        assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));

        r = home_setup(h, flags, cache, setup, NULL);
        if (r < 0)
                return r;

        r = home_load_embedded_identity(h, setup->root_fd, NULL, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
        if (r < 0)
                return r;

        r = home_update_quota_auto(h, NULL);
        if (ERRNO_IS_NOT_SUPPORTED(r))
                return -ESOCKTNOSUPPORT; /* make recognizable */
        if (r < 0)
                return r;

        r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
        if (r < 0)
                return r;

        r = home_extend_embedded_identity(new_home, h, setup);
        if (r < 0)
                return r;

        r = home_sync_and_statfs(setup->root_fd, NULL);
        if (r < 0)
                return r;

        r = home_setup_done(setup);
        if (r < 0)
                return r;

        log_info("Everything completed.");

        *ret_home = TAKE_PTR(new_home);
        return 0;
}
Commit	Line	Data
db9ecf05	1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
70a5db58 LP	2
	3	#include <sys/mount.h>
	4
	5	#include "btrfs-util.h"
	6	#include "fd-util.h"
	7	#include "homework-directory.h"
	8	#include "homework-quota.h"
	9	#include "mkdir.h"
	10	#include "mount-util.h"
	11	#include "path-util.h"
	12	#include "rm-rf.h"
	13	#include "tmpfile-util.h"
	14	#include "umask-util.h"
	15
e1df968b	16	int home_setup_directory(UserRecord h, HomeSetup setup) {
70a5db58 LP	17	assert(h);
	18	assert(setup);
	19
	20	setup->root_fd = open(user_record_image_path(h), O_RDONLY\|O_CLOEXEC\|O_DIRECTORY);
	21	if (setup->root_fd < 0)
	22	return log_error_errno(errno, "Failed to open home directory: %m");
	23
	24	return 0;
	25	}
	26
	27	int home_activate_directory(
	28	UserRecord *h,
a74e2e44	29	HomeSetup *setup,
7b78db28	30	PasswordCache *cache,
70a5db58 LP	31	UserRecord **ret_home) {
	32
	33	_cleanup_(user_record_unrefp) UserRecord new_home = NULL, header_home = NULL;
70a5db58 LP	34	const char hdo, hd, ipo, ip;
	35	int r;
	36
	37	assert(h);
	38	assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
a74e2e44	39	assert(setup);
70a5db58 LP	40	assert(ret_home);
	41
	42	assert_se(ipo = user_record_image_path(h));
2f82562b	43	ip = strdupa_safe(ipo); /* copy out, since reconciliation might cause changing of the field */
70a5db58 LP	44
70a5db58 LP	45	assert_se(hdo = user_record_home_directory(h));
2f82562b	46	hd = strdupa_safe(hdo);
70a5db58	47
a74e2e44	48	r = home_setup(h, 0, cache, setup, &header_home);
70a5db58 LP	49	if (r < 0)
	50	return r;
	51
a74e2e44	52	r = home_refresh(h, setup, header_home, cache, NULL, &new_home);
70a5db58 LP	53	if (r < 0)
	54	return r;
	55
cfef46f5 LP	56	r = home_extend_embedded_identity(new_home, h, setup);
	57	if (r < 0)
	58	return r;
	59
a74e2e44	60	setup->root_fd = safe_close(setup->root_fd);
70a5db58 LP	61
	62	/* Create mount point to mount over if necessary */
	63	if (!path_equal(ip, hd))
	64	(void) mkdir_p(hd, 0700);
	65
	66	/* Create a mount point (even if the directory is already placed correctly), as a way to indicate
	67	* this mount point is now "activated". Moreover, we want to set per-user
	68	* MS_NOSUID/MS_NOEXEC/MS_NODEV. */
511a8cfe	69	r = mount_nofollow_verbose(LOG_ERR, ip, hd, NULL, MS_BIND, NULL);
70a5db58 LP	70	if (r < 0)
	71	return r;
	72
511a8cfe	73	r = mount_nofollow_verbose(LOG_ERR, NULL, hd, NULL, MS_BIND\|MS_REMOUNT\|user_record_mount_flags(h), NULL);
70a5db58	74	if (r < 0) {
30f5d104	75	(void) umount_verbose(LOG_ERR, hd, UMOUNT_NOFOLLOW);
70a5db58 LP	76	return r;
	77	}
	78
aa0379f1 LP	79	setup->do_drop_caches = false;
aa0379f1 LP	80
70a5db58 LP	81	log_info("Everything completed.");
	82
	83	*ret_home = TAKE_PTR(new_home);
	84	return 0;
	85	}
	86
e1aeaf27	87	int home_create_directory_or_subvolume(UserRecord h, HomeSetup setup, UserRecord **ret_home) {
70a5db58 LP	88	_cleanup_(rm_rf_subvolume_and_freep) char *temporary = NULL;
70a5db58 LP	89	_cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
70a5db58 LP	90	_cleanup_free_ char *d = NULL;
	91	const char *ip;
	92	int r;
	93
	94	assert(h);
	95	assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME));
e1aeaf27	96	assert(setup);
70a5db58 LP	97	assert(ret_home);
	98
	99	assert_se(ip = user_record_image_path(h));
	100
	101	r = tempfn_random(ip, "homework", &d);
	102	if (r < 0)
	103	return log_error_errno(r, "Failed to allocate temporary directory: %m");
	104
	105	(void) mkdir_parents(d, 0755);
	106
	107	switch (user_record_storage(h)) {
	108
	109	case USER_SUBVOLUME:
	110	RUN_WITH_UMASK(0077)
	111	r = btrfs_subvol_make(d);
	112
	113	if (r >= 0) {
	114	log_info("Subvolume created.");
	115
	116	if (h->disk_size != UINT64_MAX) {
	117
	118	/* Enable quota for the subvolume we just created. Note we don't check for
	119	* errors here and only log about debug level about this. */
	120	r = btrfs_quota_enable(d, true);
	121	if (r < 0)
	122	log_debug_errno(r, "Failed to enable quota on %s, ignoring: %m", d);
	123
	124	r = btrfs_subvol_auto_qgroup(d, 0, false);
	125	if (r < 0)
	126	log_debug_errno(r, "Failed to set up automatic quota group on %s, ignoring: %m", d);
	127
	128	/* Actually configure the quota. We also ignore errors here, but we do log
	129	* about them loudly, to keep things discoverable even though we don't
	130	* consider lacking quota support in kernel fatal. */
	131	(void) home_update_quota_btrfs(h, d);
	132	}
	133
	134	break;
	135	}
	136	if (r != -ENOTTY)
	137	return log_error_errno(r, "Failed to create temporary home directory subvolume %s: %m", d);
	138
	139	log_info("Creating subvolume %s is not supported, as file system does not support subvolumes. Falling back to regular directory.", d);
	140	_fallthrough_;
	141
	142	case USER_DIRECTORY:
	143
	144	if (mkdir(d, 0700) < 0)
	145	return log_error_errno(errno, "Failed to create temporary home directory %s: %m", d);
	146
	147	(void) home_update_quota_classic(h, d);
	148	break;
	149
	150	default:
04499a70	151	assert_not_reached();
70a5db58 LP	152	}
	153
	154	temporary = TAKE_PTR(d); /* Needs to be destroyed now */
	155
e1aeaf27 LP	156	setup->root_fd = open(temporary, O_RDONLY\|O_CLOEXEC\|O_DIRECTORY\|O_NOFOLLOW);
e1aeaf27 LP	157	if (setup->root_fd < 0)
70a5db58 LP	158	return log_error_errno(errno, "Failed to open temporary home directory: %m");
70a5db58 LP	159
e1aeaf27	160	r = home_populate(h, setup->root_fd);
70a5db58 LP	161	if (r < 0)
	162	return r;
	163
e1aeaf27	164	r = home_sync_and_statfs(setup->root_fd, NULL);
70a5db58 LP	165	if (r < 0)
	166	return r;
	167
bfc0cc1a	168	r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET\|USER_RECORD_PERMISSIVE, &new_home);
70a5db58 LP	169	if (r < 0)
	170	return log_error_errno(r, "Failed to clone record: %m");
	171
	172	r = user_record_add_binding(
	173	new_home,
	174	user_record_storage(h),
	175	ip,
	176	SD_ID128_NULL,
	177	SD_ID128_NULL,
	178	SD_ID128_NULL,
	179	NULL,
	180	NULL,
	181	UINT64_MAX,
	182	NULL,
	183	NULL,
	184	h->uid,
	185	(gid_t) h->uid);
	186	if (r < 0)
	187	return log_error_errno(r, "Failed to add binding to record: %m");
	188
	189	if (rename(temporary, ip) < 0)
	190	return log_error_errno(errno, "Failed to rename %s to %s: %m", temporary, ip);
	191
	192	temporary = mfree(temporary);
	193
	194	log_info("Everything completed.");
	195
	196	*ret_home = TAKE_PTR(new_home);
	197	return 0;
	198	}
	199
	200	int home_resize_directory(
	201	UserRecord *h,
e1df968b	202	HomeSetupFlags flags,
7b78db28	203	PasswordCache *cache,
70a5db58 LP	204	HomeSetup *setup,
	205	UserRecord **ret_home) {
	206
	207	_cleanup_(user_record_unrefp) UserRecord embedded_home = NULL, new_home = NULL;
	208	int r;
	209
	210	assert(h);
	211	assert(setup);
	212	assert(ret_home);
	213	assert(IN_SET(user_record_storage(h), USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT));
	214
e1df968b	215	r = home_setup(h, flags, cache, setup, NULL);
70a5db58 LP	216	if (r < 0)
	217	return r;
	218
7b78db28	219	r = home_load_embedded_identity(h, setup->root_fd, NULL, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
70a5db58 LP	220	if (r < 0)
	221	return r;
	222
	223	r = home_update_quota_auto(h, NULL);
	224	if (ERRNO_IS_NOT_SUPPORTED(r))
	225	return -ESOCKTNOSUPPORT; /* make recognizable */
	226	if (r < 0)
	227	return r;
	228
	229	r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
	230	if (r < 0)
	231	return r;
	232
	233	r = home_extend_embedded_identity(new_home, h, setup);
	234	if (r < 0)
	235	return r;
	236
	237	r = home_sync_and_statfs(setup->root_fd, NULL);
	238	if (r < 0)
	239	return r;
	240
66aa51f8	241	r = home_setup_done(setup);
70a5db58 LP	242	if (r < 0)
	243	return r;
	244
	245	log_info("Everything completed.");
	246
	247	*ret_home = TAKE_PTR(new_home);
	248	return 0;
	249	}