]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #1140 from poettering/sd-event-signals
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
88213476
LP		 1/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
2
3/***
4 This file is part of systemd.
5
6 Copyright 2010 Lennart Poettering
7
8 systemd is free software; you can redistribute it and/or modify it
5430f7f2
LP		 9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
88213476
LP		 11 (at your option) any later version.
12
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2 16 Lesser General Public License for more details.
88213476 17
5430f7f2 18 You should have received a copy of the GNU Lesser General Public License
88213476
LP		 19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20***/
21
22#include <signal.h>
23#include <sched.h>
24#include <unistd.h>
25#include <sys/types.h>
88213476 26#include <sys/mount.h>
88213476
LP		 27#include <stdlib.h>
28#include <string.h>
29#include <stdio.h>
30#include <errno.h>
31#include <sys/prctl.h>
88213476 32#include <getopt.h>
687d0825 33#include <grp.h>
5ed27dbd 34#include <linux/fs.h>
9537eab0 35#include <sys/socket.h>
aea38d80 36#include <linux/netlink.h>
aa28aefe 37#include <net/if.h>
69c79d3c 38#include <linux/veth.h>
6afc95b7 39#include <sys/personality.h>
1b9e5b12 40#include <linux/loop.h>
2fbe4296 41#include <sys/file.h>
aa28aefe 42
5d63309c 43#ifdef HAVE_SELINUX
a8828ed9
DW		 44#include <selinux/selinux.h>
45#endif
88213476 46
24fb1112
LP		 47#ifdef HAVE_SECCOMP
48#include <seccomp.h>
49#endif
50
1b9e5b12
LP		 51#ifdef HAVE_BLKID
52#include <blkid/blkid.h>
53#endif
54
1f0cd86b
LP		 55#include "sd-daemon.h"
56#include "sd-bus.h"
57#include "sd-id128.h"
1c4baffc 58#include "sd-netlink.h"
958b66ea 59#include "random-util.h"
88213476
LP		 60#include "log.h"
61#include "util.h"
49e942b2 62#include "mkdir.h"
c6878637 63#include "rm-rf.h"
6b2d0e85 64#include "macro.h"
94d82985 65#include "missing.h"
04d391da 66#include "cgroup-util.h"
a258bf26 67#include "strv.h"
9eb977db 68#include "path-util.h"
a41fe3a2 69#include "loopback-setup.h"
4fc9982c 70#include "dev-setup.h"
842f3b0f 71#include "fdset.h"
acbeb427 72#include "build.h"
a5c32cff 73#include "fileio.h"
40ca29a1 74#include "bus-util.h"
1f0cd86b 75#include "bus-error.h"
4ba93280 76#include "ptyfwd.h"
f4889f65 77#include "env-util.h"
1c4baffc 78#include "netlink-util.h"
7e227024 79#include "udev-util.h"
1b9e5b12
LP		 80#include "blkid-util.h"
81#include "gpt.h"
01dde061 82#include "siphash24.h"
849958d1 83#include "copy.h"
3577de7a 84#include "base-filesystem.h"
a2da110b 85#include "barrier.h"
023fb90b 86#include "event-util.h"
f01ae826 87#include "capability.h"
2822da4f 88#include "cap-list.h"
ec16945e 89#include "btrfs-util.h"
1b9cebf6 90#include "machine-image.h"
6d0b55c2
LP		 91#include "list.h"
92#include "in-addr-util.h"
12c2884c 93#include "firewall-util.h"
6d0b55c2 94#include "local-addresses.h"
6482f626 95#include "formats-util.h"
0b452006 96#include "process-util.h"
288a74cc 97#include "terminal-util.h"
958b66ea 98#include "hostname-util.h"
24882e06 99#include "signal-util.h"
f2d88580 100
e9642be2
LP		 101#ifdef HAVE_SECCOMP
102#include "seccomp-util.h"
103#endif
104
6d0b55c2
LP		 105typedef struct ExposePort {
106 int protocol;
107 uint16_t host_port;
108 uint16_t container_port;
109 LIST_FIELDS(struct ExposePort, ports);
110} ExposePort;
111
113cea80
DH		 112typedef enum ContainerStatus {
113 CONTAINER_TERMINATED,
114 CONTAINER_REBOOTED
115} ContainerStatus;
116
57fb9fb5
LP		 117typedef enum LinkJournal {
118 LINK_NO,
119 LINK_AUTO,
120 LINK_HOST,
121 LINK_GUEST
122} LinkJournal;
88213476 123
4d9f07b4
LP		 124typedef enum Volatile {
125 VOLATILE_NO,
126 VOLATILE_YES,
127 VOLATILE_STATE,
128} Volatile;
129
5a8af538
LP		 130typedef enum CustomMountType {
131 CUSTOM_MOUNT_BIND,
132 CUSTOM_MOUNT_TMPFS,
133 CUSTOM_MOUNT_OVERLAY,
134} CustomMountType;
135
136typedef struct CustomMount {
137 CustomMountType type;
138 bool read_only;
139 char *source; /* for overlayfs this is the upper directory */
140 char *destination;
141 char *options;
142 char *work_dir;
143 char **lower;
144} CustomMount;
145
88213476 146static char *arg_directory = NULL;
ec16945e 147static char *arg_template = NULL;
687d0825 148static char *arg_user = NULL;
9444b1f2 149static sd_id128_t arg_uuid = {};
7027ff61 150static char *arg_machine = NULL;
c74e630d
LP		 151static const char *arg_selinux_context = NULL;
152static const char *arg_selinux_apifs_context = NULL;
9444b1f2 153static const char *arg_slice = NULL;
ff01d048 154static bool arg_private_network = false;
bc2f673e 155static bool arg_read_only = false;
0f0dbc46 156static bool arg_boot = false;
ec16945e 157static bool arg_ephemeral = false;
57fb9fb5 158static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 159static bool arg_link_journal_try = false;
5076f0cc
LP		 160static uint64_t arg_retain =
161 (1ULL << CAP_CHOWN) |
162 (1ULL << CAP_DAC_OVERRIDE) |
163 (1ULL << CAP_DAC_READ_SEARCH) |
164 (1ULL << CAP_FOWNER) |
165 (1ULL << CAP_FSETID) |
166 (1ULL << CAP_IPC_OWNER) |
167 (1ULL << CAP_KILL) |
168 (1ULL << CAP_LEASE) |
169 (1ULL << CAP_LINUX_IMMUTABLE) |
170 (1ULL << CAP_NET_BIND_SERVICE) |
171 (1ULL << CAP_NET_BROADCAST) |
172 (1ULL << CAP_NET_RAW) |
173 (1ULL << CAP_SETGID) |
174 (1ULL << CAP_SETFCAP) |
175 (1ULL << CAP_SETPCAP) |
176 (1ULL << CAP_SETUID) |
177 (1ULL << CAP_SYS_ADMIN) |
178 (1ULL << CAP_SYS_CHROOT) |
179 (1ULL << CAP_SYS_NICE) |
180 (1ULL << CAP_SYS_PTRACE) |
181 (1ULL << CAP_SYS_TTY_CONFIG) |
d87be9b0 182 (1ULL << CAP_SYS_RESOURCE) |
88d04e31
LP		 183 (1ULL << CAP_SYS_BOOT) |
184 (1ULL << CAP_AUDIT_WRITE) |
7f112f50
LP		 185 (1ULL << CAP_AUDIT_CONTROL) |
186 (1ULL << CAP_MKNOD);
5a8af538
LP		 187static CustomMount *arg_custom_mounts = NULL;
188static unsigned arg_n_custom_mounts = 0;
f4889f65 189static char **arg_setenv = NULL;
284c0b91 190static bool arg_quiet = false;
8a96d94e 191static bool arg_share_system = false;
eb91eb18 192static bool arg_register = true;
89f7c846 193static bool arg_keep_unit = false;
aa28aefe 194static char **arg_network_interfaces = NULL;
c74e630d 195static char **arg_network_macvlan = NULL;
4bbfe7ad 196static char **arg_network_ipvlan = NULL;
69c79d3c 197static bool arg_network_veth = false;
c74e630d 198static const char *arg_network_bridge = NULL;
050f7277 199static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 200static char *arg_image = NULL;
4d9f07b4 201static Volatile arg_volatile = VOLATILE_NO;
6d0b55c2 202static ExposePort *arg_expose_ports = NULL;
f36933fe 203static char **arg_property = NULL;
6dac160c
LP		 204static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
205static bool arg_userns = false;
c6c8f6e2 206static int arg_kill_signal = 0;
efdb0237 207static bool arg_unified_cgroup_hierarchy = false;
88213476 208
601185b4 209static void help(void) {
88213476
LP		 210 printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
211 "Spawn a minimal namespace container for debugging, testing and building.\n\n"
a8828ed9
DW		 212 " -h --help Show this help\n"
213 " --version Print version string\n"
69c79d3c 214 " -q --quiet Do not show status information\n"
1b9e5b12 215 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 216 " --template=PATH Initialize root directory from template directory,\n"
217 " if missing\n"
218 " -x --ephemeral Run container with snapshot of root directory, and\n"
219 " remove it after exit\n"
220 " -i --image=PATH File system device or disk image for the container\n"
a8828ed9
DW		 221 " -b --boot Boot up full system (i.e. invoke init)\n"
222 " -u --user=USER Run the command under specified user or uid\n"
a8828ed9 223 " -M --machine=NAME Set the machine name for the container\n"
69c79d3c 224 " --uuid=UUID Set a specific machine UUID for the container\n"
a8828ed9 225 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 226 " --property=NAME=VALUE Set scope unit property\n"
03cfe0d5
LP		 227 " --private-users[=UIDBASE[:NUIDS]]\n"
228 " Run within user namespace\n"
69c79d3c
LP		 229 " --private-network Disable network in container\n"
230 " --network-interface=INTERFACE\n"
231 " Assign an existing network interface to the\n"
232 " container\n"
c74e630d
LP		 233 " --network-macvlan=INTERFACE\n"
234 " Create a macvlan network interface based on an\n"
235 " existing network interface to the container\n"
4bbfe7ad
TG		 236 " --network-ipvlan=INTERFACE\n"
237 " Create a ipvlan network interface based on an\n"
238 " existing network interface to the container\n"
0dfaa006 239 " -n --network-veth Add a virtual ethernet connection between host\n"
69c79d3c 240 " and container\n"
ab046dde 241 " --network-bridge=INTERFACE\n"
32457153 242 " Add a virtual ethernet connection between host\n"
ab046dde
TG		 243 " and container and add it to an existing bridge on\n"
244 " the host\n"
6d0b55c2 245 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
ab5e3a1b 246 " Expose a container IP port on the host\n"
82adf6af
LP		 247 " -Z --selinux-context=SECLABEL\n"
248 " Set the SELinux security context to be used by\n"
249 " processes in the container\n"
250 " -L --selinux-apifs-context=SECLABEL\n"
251 " Set the SELinux security context to be used by\n"
252 " API/tmpfs file systems in the container\n"
a8828ed9
DW		 253 " --capability=CAP In addition to the default, retain specified\n"
254 " capability\n"
255 " --drop-capability=CAP Drop the specified capability from the default set\n"
c6c8f6e2 256 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
574edc90
MP		 257 " --link-journal=MODE Link up guest journal, one of no, auto, guest, host,\n"
258 " try-guest, try-host\n"
259 " -j Equivalent to --link-journal=try-guest\n"
69c79d3c 260 " --read-only Mount the root directory read-only\n"
5e5bfa6e
EY		 261 " --bind=PATH[:PATH[:OPTIONS]]\n"
262 " Bind mount a file or directory from the host into\n"
a8828ed9 263 " the container\n"
5e5bfa6e
EY		 264 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
265 " Similar, but creates a read-only bind mount\n"
06c17c39 266 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 267 " --overlay=PATH[:PATH...]:PATH\n"
268 " Create an overlay mount from the host to \n"
269 " the container\n"
270 " --overlay-ro=PATH[:PATH...]:PATH\n"
271 " Similar, but creates a read-only overlay mount\n"
284c0b91 272 " --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
69c79d3c 273 " --share-system Share system namespaces with host\n"
eb91eb18 274 " --register=BOOLEAN Register container as machine\n"
89f7c846 275 " --keep-unit Do not register a scope for the machine, reuse\n"
4d9f07b4 276 " the service unit nspawn is running in\n"
6d0b55c2
LP		 277 " --volatile[=MODE] Run the system in volatile mode\n"
278 , program_invocation_short_name);
88213476
LP		 279}
280
5a8af538
LP		 281static CustomMount* custom_mount_add(CustomMountType t) {
282 CustomMount *c, *ret;
283
284 c = realloc(arg_custom_mounts, (arg_n_custom_mounts + 1) * sizeof(CustomMount));
285 if (!c)
286 return NULL;
287
288 arg_custom_mounts = c;
289 ret = arg_custom_mounts + arg_n_custom_mounts;
290 arg_n_custom_mounts++;
291
292 *ret = (CustomMount) { .type = t };
293
294 return ret;
295}
296
297static void custom_mount_free_all(void) {
298 unsigned i;
299
300 for (i = 0; i < arg_n_custom_mounts; i++) {
301 CustomMount *m = &arg_custom_mounts[i];
302
303 free(m->source);
304 free(m->destination);
305 free(m->options);
306
307 if (m->work_dir) {
308 (void) rm_rf(m->work_dir, REMOVE_ROOT|REMOVE_PHYSICAL);
309 free(m->work_dir);
310 }
311
312 strv_free(m->lower);
313 }
314
97b11eed 315 arg_custom_mounts = mfree(arg_custom_mounts);
5a8af538
LP		 316 arg_n_custom_mounts = 0;
317}
318
319static int custom_mount_compare(const void *a, const void *b) {
320 const CustomMount *x = a, *y = b;
321 int r;
322
323 r = path_compare(x->destination, y->destination);
324 if (r != 0)
325 return r;
326
327 if (x->type < y->type)
328 return -1;
329 if (x->type > y->type)
330 return 1;
331
332 return 0;
333}
334
335static int custom_mounts_prepare(void) {
336 unsigned i;
337 int r;
338
339 /* Ensure the mounts are applied prefix first. */
340 qsort_safe(arg_custom_mounts, arg_n_custom_mounts, sizeof(CustomMount), custom_mount_compare);
341
342 /* Allocate working directories for the overlay file systems that need it */
343 for (i = 0; i < arg_n_custom_mounts; i++) {
344 CustomMount *m = &arg_custom_mounts[i];
345
825d5287
RM		 346 if (arg_userns && arg_uid_shift == UID_INVALID && path_equal(m->destination, "/")) {
347 log_error("--private-users with automatic UID shift may not be combined with custom root mounts.");
348 return -EINVAL;
349 }
350
5a8af538
LP		 351 if (m->type != CUSTOM_MOUNT_OVERLAY)
352 continue;
353
354 if (m->work_dir)
355 continue;
356
357 if (m->read_only)
358 continue;
359
14bcf25c 360 r = tempfn_random(m->source, NULL, &m->work_dir);
5a8af538
LP		 361 if (r < 0)
362 return log_error_errno(r, "Failed to generate work directory from %s: %m", m->source);
363 }
364
365 return 0;
366}
367
ec16945e
LP		 368static int set_sanitized_path(char **b, const char *path) {
369 char *p;
370
371 assert(b);
372 assert(path);
373
374 p = canonicalize_file_name(path);
375 if (!p) {
376 if (errno != ENOENT)
377 return -errno;
378
379 p = path_make_absolute_cwd(path);
380 if (!p)
381 return -ENOMEM;
382 }
383
384 free(*b);
385 *b = path_kill_slashes(p);
386 return 0;
387}
388
efdb0237
LP		 389static int detect_unified_cgroup_hierarchy(void) {
390 const char *e;
391 int r;
392
393 /* Allow the user to control whether the unified hierarchy is used */
394 e = getenv("UNIFIED_CGROUP_HIERARCHY");
395 if (e) {
396 r = parse_boolean(e);
397 if (r < 0)
398 return log_error_errno(r, "Failed to parse $UNIFIED_CGROUP_HIERARCHY.");
399
400 arg_unified_cgroup_hierarchy = r;
401 return 0;
402 }
403
404 /* Otherwise inherit the default from the host system */
405 r = cg_unified();
406 if (r < 0)
407 return log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
408
409 arg_unified_cgroup_hierarchy = r;
410 return 0;
411}
412
88213476
LP		 413static int parse_argv(int argc, char *argv[]) {
414
a41fe3a2 415 enum {
acbeb427
ZJS		 416 ARG_VERSION = 0x100,
417 ARG_PRIVATE_NETWORK,
bc2f673e 418 ARG_UUID,
5076f0cc 419 ARG_READ_ONLY,
57fb9fb5 420 ARG_CAPABILITY,
420c7379 421 ARG_DROP_CAPABILITY,
17fe0523
LP		 422 ARG_LINK_JOURNAL,
423 ARG_BIND,
f4889f65 424 ARG_BIND_RO,
06c17c39 425 ARG_TMPFS,
5a8af538
LP		 426 ARG_OVERLAY,
427 ARG_OVERLAY_RO,
f4889f65 428 ARG_SETENV,
eb91eb18 429 ARG_SHARE_SYSTEM,
89f7c846 430 ARG_REGISTER,
aa28aefe 431 ARG_KEEP_UNIT,
69c79d3c 432 ARG_NETWORK_INTERFACE,
c74e630d 433 ARG_NETWORK_MACVLAN,
4bbfe7ad 434 ARG_NETWORK_IPVLAN,
ab046dde 435 ARG_NETWORK_BRIDGE,
6afc95b7 436 ARG_PERSONALITY,
4d9f07b4 437 ARG_VOLATILE,
ec16945e 438 ARG_TEMPLATE,
f36933fe 439 ARG_PROPERTY,
6dac160c 440 ARG_PRIVATE_USERS,
c6c8f6e2 441 ARG_KILL_SIGNAL,
a41fe3a2
LP		 442 };
443
88213476 444 static const struct option options[] = {
aa28aefe
LP		 445 { "help", no_argument, NULL, 'h' },
446 { "version", no_argument, NULL, ARG_VERSION },
447 { "directory", required_argument, NULL, 'D' },
ec16945e
LP		 448 { "template", required_argument, NULL, ARG_TEMPLATE },
449 { "ephemeral", no_argument, NULL, 'x' },
aa28aefe
LP		 450 { "user", required_argument, NULL, 'u' },
451 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
452 { "boot", no_argument, NULL, 'b' },
453 { "uuid", required_argument, NULL, ARG_UUID },
454 { "read-only", no_argument, NULL, ARG_READ_ONLY },
455 { "capability", required_argument, NULL, ARG_CAPABILITY },
456 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
457 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
458 { "bind", required_argument, NULL, ARG_BIND },
459 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
06c17c39 460 { "tmpfs", required_argument, NULL, ARG_TMPFS },
5a8af538
LP		 461 { "overlay", required_argument, NULL, ARG_OVERLAY },
462 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
aa28aefe
LP		 463 { "machine", required_argument, NULL, 'M' },
464 { "slice", required_argument, NULL, 'S' },
465 { "setenv", required_argument, NULL, ARG_SETENV },
466 { "selinux-context", required_argument, NULL, 'Z' },
467 { "selinux-apifs-context", required_argument, NULL, 'L' },
468 { "quiet", no_argument, NULL, 'q' },
469 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM },
470 { "register", required_argument, NULL, ARG_REGISTER },
471 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
472 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
c74e630d 473 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
4bbfe7ad 474 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
0dfaa006 475 { "network-veth", no_argument, NULL, 'n' },
ab046dde 476 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
6afc95b7 477 { "personality", required_argument, NULL, ARG_PERSONALITY },
1b9e5b12 478 { "image", required_argument, NULL, 'i' },
4d9f07b4 479 { "volatile", optional_argument, NULL, ARG_VOLATILE },
6d0b55c2 480 { "port", required_argument, NULL, 'p' },
f36933fe 481 { "property", required_argument, NULL, ARG_PROPERTY },
6dac160c 482 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
c6c8f6e2 483 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
eb9da376 484 {}
88213476
LP		 485 };
486
9444b1f2 487 int c, r;
a42c8b54 488 uint64_t plus = 0, minus = 0;
88213476
LP		 489
490 assert(argc >= 0);
491 assert(argv);
492
0dfaa006 493 while ((c = getopt_long(argc, argv, "+hD:u:bL:M:jS:Z:qi:xp:n", options, NULL)) >= 0)
88213476
LP		 494
495 switch (c) {
496
497 case 'h':
601185b4
ZJS		 498 help();
499 return 0;
88213476 500
acbeb427
ZJS		 501 case ARG_VERSION:
502 puts(PACKAGE_STRING);
503 puts(SYSTEMD_FEATURES);
504 return 0;
505
88213476 506 case 'D':
ec16945e
LP		 507 r = set_sanitized_path(&arg_directory, optarg);
508 if (r < 0)
509 return log_error_errno(r, "Invalid root directory: %m");
510
511 break;
512
513 case ARG_TEMPLATE:
514 r = set_sanitized_path(&arg_template, optarg);
515 if (r < 0)
516 return log_error_errno(r, "Invalid template directory: %m");
88213476
LP		 517
518 break;
519
1b9e5b12 520 case 'i':
ec16945e
LP		 521 r = set_sanitized_path(&arg_image, optarg);
522 if (r < 0)
523 return log_error_errno(r, "Invalid image path: %m");
524
525 break;
526
527 case 'x':
528 arg_ephemeral = true;
1b9e5b12
LP		 529 break;
530
687d0825 531 case 'u':
2fc09a9c
DM		 532 r = free_and_strdup(&arg_user, optarg);
533 if (r < 0)
7027ff61 534 return log_oom();
687d0825
MV		 535
536 break;
537
ab046dde 538 case ARG_NETWORK_BRIDGE:
c74e630d 539 arg_network_bridge = optarg;
ab046dde
TG		 540
541 /* fall through */
542
0dfaa006 543 case 'n':
69c79d3c
LP		 544 arg_network_veth = true;
545 arg_private_network = true;
546 break;
547
aa28aefe 548 case ARG_NETWORK_INTERFACE:
c74e630d
LP		 549 if (strv_extend(&arg_network_interfaces, optarg) < 0)
550 return log_oom();
551
552 arg_private_network = true;
553 break;
554
555 case ARG_NETWORK_MACVLAN:
556 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 557 return log_oom();
558
4bbfe7ad
TG		 559 arg_private_network = true;
560 break;
561
562 case ARG_NETWORK_IPVLAN:
563 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
564 return log_oom();
565
aa28aefe
LP		 566 /* fall through */
567
ff01d048
LP		 568 case ARG_PRIVATE_NETWORK:
569 arg_private_network = true;
a41fe3a2
LP		 570 break;
571
0f0dbc46
LP		 572 case 'b':
573 arg_boot = true;
574 break;
575
144f0fc0 576 case ARG_UUID:
9444b1f2
LP		 577 r = sd_id128_from_string(optarg, &arg_uuid);
578 if (r < 0) {
aa96c6cb 579 log_error("Invalid UUID: %s", optarg);
9444b1f2 580 return r;
aa96c6cb 581 }
9444b1f2 582 break;
aa96c6cb 583
9444b1f2 584 case 'S':
c74e630d 585 arg_slice = optarg;
144f0fc0
LP		 586 break;
587
7027ff61 588 case 'M':
c1521918 589 if (isempty(optarg))
97b11eed 590 arg_machine = mfree(arg_machine);
c1521918 591 else {
0c3c4284 592 if (!machine_name_is_valid(optarg)) {
eb91eb18
LP		 593 log_error("Invalid machine name: %s", optarg);
594 return -EINVAL;
595 }
7027ff61 596
0c3c4284
LP		 597 r = free_and_strdup(&arg_machine, optarg);
598 if (r < 0)
eb91eb18
LP		 599 return log_oom();
600
601 break;
602 }
7027ff61 603
82adf6af
LP		 604 case 'Z':
605 arg_selinux_context = optarg;
a8828ed9
DW		 606 break;
607
82adf6af
LP		 608 case 'L':
609 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 610 break;
611
bc2f673e
LP		 612 case ARG_READ_ONLY:
613 arg_read_only = true;
614 break;
615
420c7379
LP		 616 case ARG_CAPABILITY:
617 case ARG_DROP_CAPABILITY: {
a2a5291b 618 const char *state, *word;
5076f0cc
LP		 619 size_t length;
620
621 FOREACH_WORD_SEPARATOR(word, length, optarg, ",", state) {
39ed67d1 622 _cleanup_free_ char *t;
5076f0cc
LP		 623
624 t = strndup(word, length);
0d0f0c50
SL		 625 if (!t)
626 return log_oom();
5076f0cc 627
39ed67d1
LP		 628 if (streq(t, "all")) {
629 if (c == ARG_CAPABILITY)
a42c8b54 630 plus = (uint64_t) -1;
39ed67d1 631 else
a42c8b54 632 minus = (uint64_t) -1;
39ed67d1 633 } else {
2822da4f
LP		 634 int cap;
635
636 cap = capability_from_name(t);
637 if (cap < 0) {
39ed67d1
LP		 638 log_error("Failed to parse capability %s.", t);
639 return -EINVAL;
640 }
641
642 if (c == ARG_CAPABILITY)
a42c8b54 643 plus |= 1ULL << (uint64_t) cap;
39ed67d1 644 else
a42c8b54 645 minus |= 1ULL << (uint64_t) cap;
5076f0cc 646 }
5076f0cc
LP		 647 }
648
649 break;
650 }
651
57fb9fb5
LP		 652 case 'j':
653 arg_link_journal = LINK_GUEST;
574edc90 654 arg_link_journal_try = true;
57fb9fb5
LP		 655 break;
656
657 case ARG_LINK_JOURNAL:
53e438e3 658 if (streq(optarg, "auto")) {
57fb9fb5 659 arg_link_journal = LINK_AUTO;
53e438e3
LP		 660 arg_link_journal_try = false;
661 } else if (streq(optarg, "no")) {
57fb9fb5 662 arg_link_journal = LINK_NO;
53e438e3
LP		 663 arg_link_journal_try = false;
664 } else if (streq(optarg, "guest")) {
57fb9fb5 665 arg_link_journal = LINK_GUEST;
53e438e3
LP		 666 arg_link_journal_try = false;
667 } else if (streq(optarg, "host")) {
57fb9fb5 668 arg_link_journal = LINK_HOST;
53e438e3
LP		 669 arg_link_journal_try = false;
670 } else if (streq(optarg, "try-guest")) {
574edc90
MP		 671 arg_link_journal = LINK_GUEST;
672 arg_link_journal_try = true;
673 } else if (streq(optarg, "try-host")) {
674 arg_link_journal = LINK_HOST;
675 arg_link_journal_try = true;
676 } else {
57fb9fb5
LP		 677 log_error("Failed to parse link journal mode %s", optarg);
678 return -EINVAL;
679 }
680
681 break;
682
17fe0523
LP		 683 case ARG_BIND:
684 case ARG_BIND_RO: {
e4a5d9ed 685 const char *current = optarg;
5e5bfa6e 686 _cleanup_free_ char *source = NULL, *destination = NULL, *opts = NULL;
5a8af538 687 CustomMount *m;
17fe0523 688
5e5bfa6e 689 r = extract_many_words(&current, ":", EXTRACT_DONT_COALESCE_SEPARATORS, &source, &destination, &opts, NULL);
e4a5d9ed
RM		 690 switch (r) {
691 case 1:
692 destination = strdup(source);
693 case 2:
5e5bfa6e 694 case 3:
e4a5d9ed
RM		 695 break;
696 case -ENOMEM:
697 return log_oom();
698 default:
699 log_error("Invalid bind mount specification: %s", optarg);
700 return -EINVAL;
17fe0523
LP		 701 }
702
5a8af538 703 if (!source || !destination)
17fe0523
LP		 704 return log_oom();
705
5a8af538 706 if (!path_is_absolute(source) || !path_is_absolute(destination)) {
17fe0523
LP		 707 log_error("Invalid bind mount specification: %s", optarg);
708 return -EINVAL;
709 }
710
5a8af538
LP		 711 m = custom_mount_add(CUSTOM_MOUNT_BIND);
712 if (!m)
b3451bed 713 return log_oom();
17fe0523 714
5a8af538
LP		 715 m->source = source;
716 m->destination = destination;
717 m->read_only = c == ARG_BIND_RO;
5e5bfa6e 718 m->options = opts;
5a8af538 719
5e5bfa6e 720 source = destination = opts = NULL;
17fe0523
LP		 721
722 break;
723 }
724
06c17c39 725 case ARG_TMPFS: {
6330ee10 726 const char *current = optarg;
5a8af538
LP		 727 _cleanup_free_ char *path = NULL, *opts = NULL;
728 CustomMount *m;
06c17c39 729
6330ee10
RM		 730 r = extract_first_word(&current, &path, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
731 if (r == -ENOMEM)
732 return log_oom();
733 else if (r < 0) {
734 log_error("Invalid tmpfs specification: %s", optarg);
735 return r;
06c17c39 736 }
6330ee10
RM		 737 if (r)
738 opts = strdup(current);
739 else
740 opts = strdup("mode=0755");
06c17c39 741
5a8af538 742 if (!path || !opts)
06c17c39
LP		 743 return log_oom();
744
5a8af538 745 if (!path_is_absolute(path)) {
06c17c39
LP		 746 log_error("Invalid tmpfs specification: %s", optarg);
747 return -EINVAL;
748 }
749
5a8af538
LP		 750 m = custom_mount_add(CUSTOM_MOUNT_TMPFS);
751 if (!m)
06c17c39
LP		 752 return log_oom();
753
5a8af538
LP		 754 m->destination = path;
755 m->options = opts;
06c17c39 756
5a8af538
LP		 757 path = opts = NULL;
758
759 break;
760 }
761
762 case ARG_OVERLAY:
763 case ARG_OVERLAY_RO: {
764 _cleanup_free_ char *upper = NULL, *destination = NULL;
765 _cleanup_strv_free_ char **lower = NULL;
766 CustomMount *m;
767 unsigned n = 0;
768 char **i;
769
62f9f39a
RM		 770 r = strv_split_extract(&lower, optarg, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
771 if (r == -ENOMEM)
06c17c39 772 return log_oom();
62f9f39a
RM		 773 else if (r < 0) {
774 log_error("Invalid overlay specification: %s", optarg);
775 return r;
776 }
06c17c39 777
5a8af538
LP		 778 STRV_FOREACH(i, lower) {
779 if (!path_is_absolute(*i)) {
780 log_error("Overlay path %s is not absolute.", *i);
781 return -EINVAL;
782 }
783
784 n++;
785 }
786
787 if (n < 2) {
788 log_error("--overlay= needs at least two colon-separated directories specified.");
789 return -EINVAL;
790 }
791
792 if (n == 2) {
793 /* If two parameters are specified,
794 * the first one is the lower, the
795 * second one the upper directory. And
af86c440
ZJS		 796 * we'll also define the destination
797 * mount point the same as the upper. */
5a8af538
LP		 798 upper = lower[1];
799 lower[1] = NULL;
800
801 destination = strdup(upper);
802 if (!destination)
803 return log_oom();
804
805 } else {
806 upper = lower[n - 2];
807 destination = lower[n - 1];
808 lower[n - 2] = NULL;
809 }
810
811 m = custom_mount_add(CUSTOM_MOUNT_OVERLAY);
812 if (!m)
813 return log_oom();
814
815 m->destination = destination;
816 m->source = upper;
817 m->lower = lower;
818 m->read_only = c == ARG_OVERLAY_RO;
819
820 upper = destination = NULL;
821 lower = NULL;
06c17c39
LP		 822
823 break;
824 }
825
f4889f65
LP		 826 case ARG_SETENV: {
827 char **n;
828
829 if (!env_assignment_is_valid(optarg)) {
830 log_error("Environment variable assignment '%s' is not valid.", optarg);
831 return -EINVAL;
832 }
833
834 n = strv_env_set(arg_setenv, optarg);
835 if (!n)
836 return log_oom();
837
838 strv_free(arg_setenv);
839 arg_setenv = n;
840 break;
841 }
842
284c0b91
LP		 843 case 'q':
844 arg_quiet = true;
845 break;
846
8a96d94e
LP		 847 case ARG_SHARE_SYSTEM:
848 arg_share_system = true;
849 break;
850
eb91eb18
LP		 851 case ARG_REGISTER:
852 r = parse_boolean(optarg);
853 if (r < 0) {
854 log_error("Failed to parse --register= argument: %s", optarg);
855 return r;
856 }
857
858 arg_register = r;
859 break;
860
89f7c846
LP		 861 case ARG_KEEP_UNIT:
862 arg_keep_unit = true;
863 break;
864
6afc95b7
LP		 865 case ARG_PERSONALITY:
866
ac45f971 867 arg_personality = personality_from_string(optarg);
050f7277 868 if (arg_personality == PERSONALITY_INVALID) {
6afc95b7
LP		 869 log_error("Unknown or unsupported personality '%s'.", optarg);
870 return -EINVAL;
871 }
872
873 break;
874
4d9f07b4
LP		 875 case ARG_VOLATILE:
876
877 if (!optarg)
878 arg_volatile = VOLATILE_YES;
879 else {
880 r = parse_boolean(optarg);
881 if (r < 0) {
882 if (streq(optarg, "state"))
883 arg_volatile = VOLATILE_STATE;
884 else {
885 log_error("Failed to parse --volatile= argument: %s", optarg);
886 return r;
887 }
888 } else
889 arg_volatile = r ? VOLATILE_YES : VOLATILE_NO;
890 }
891
892 break;
893
6d0b55c2
LP		 894 case 'p': {
895 const char *split, *e;
896 uint16_t container_port, host_port;
897 int protocol;
898 ExposePort *p;
899
900 if ((e = startswith(optarg, "tcp:")))
901 protocol = IPPROTO_TCP;
902 else if ((e = startswith(optarg, "udp:")))
903 protocol = IPPROTO_UDP;
904 else {
905 e = optarg;
906 protocol = IPPROTO_TCP;
907 }
908
909 split = strchr(e, ':');
910 if (split) {
911 char v[split - e + 1];
912
913 memcpy(v, e, split - e);
914 v[split - e] = 0;
915
916 r = safe_atou16(v, &host_port);
917 if (r < 0 || host_port <= 0) {
918 log_error("Failed to parse host port: %s", optarg);
919 return -EINVAL;
920 }
921
922 r = safe_atou16(split + 1, &container_port);
923 } else {
924 r = safe_atou16(e, &container_port);
925 host_port = container_port;
926 }
927
928 if (r < 0 || container_port <= 0) {
929 log_error("Failed to parse host port: %s", optarg);
930 return -EINVAL;
931 }
932
933 LIST_FOREACH(ports, p, arg_expose_ports) {
934 if (p->protocol == protocol && p->host_port == host_port) {
935 log_error("Duplicate port specification: %s", optarg);
936 return -EINVAL;
937 }
938 }
939
940 p = new(ExposePort, 1);
941 if (!p)
942 return log_oom();
943
944 p->protocol = protocol;
945 p->host_port = host_port;
946 p->container_port = container_port;
947
948 LIST_PREPEND(ports, arg_expose_ports, p);
949
950 break;
951 }
952
f36933fe
LP		 953 case ARG_PROPERTY:
954 if (strv_extend(&arg_property, optarg) < 0)
955 return log_oom();
956
957 break;
958
6dac160c
LP		 959 case ARG_PRIVATE_USERS:
960 if (optarg) {
961 _cleanup_free_ char *buffer = NULL;
962 const char *range, *shift;
963
964 range = strchr(optarg, ':');
965 if (range) {
966 buffer = strndup(optarg, range - optarg);
967 if (!buffer)
968 return log_oom();
969 shift = buffer;
970
971 range++;
972 if (safe_atou32(range, &arg_uid_range) < 0 || arg_uid_range <= 0) {
973 log_error("Failed to parse UID range: %s", range);
974 return -EINVAL;
975 }
976 } else
977 shift = optarg;
978
979 if (parse_uid(shift, &arg_uid_shift) < 0) {
980 log_error("Failed to parse UID: %s", optarg);
981 return -EINVAL;
982 }
983 }
984
985 arg_userns = true;
986 break;
987
c6c8f6e2
LP		 988 case ARG_KILL_SIGNAL:
989 arg_kill_signal = signal_from_string_try_harder(optarg);
990 if (arg_kill_signal < 0) {
991 log_error("Cannot parse signal: %s", optarg);
992 return -EINVAL;
993 }
994
995 break;
996
88213476
LP		 997 case '?':
998 return -EINVAL;
999
1000 default:
eb9da376 1001 assert_not_reached("Unhandled option");
88213476 1002 }
88213476 1003
eb91eb18
LP		 1004 if (arg_share_system)
1005 arg_register = false;
1006
1007 if (arg_boot && arg_share_system) {
1008 log_error("--boot and --share-system may not be combined.");
1009 return -EINVAL;
1010 }
1011
89f7c846
LP		 1012 if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
1013 log_error("--keep-unit may not be used when invoked from a user session.");
1014 return -EINVAL;
1015 }
1016
1b9e5b12
LP		 1017 if (arg_directory && arg_image) {
1018 log_error("--directory= and --image= may not be combined.");
1019 return -EINVAL;
1020 }
1021
ec16945e
LP		 1022 if (arg_template && arg_image) {
1023 log_error("--template= and --image= may not be combined.");
1024 return -EINVAL;
1025 }
1026
1027 if (arg_template && !(arg_directory || arg_machine)) {
1028 log_error("--template= needs --directory= or --machine=.");
1029 return -EINVAL;
1030 }
1031
1032 if (arg_ephemeral && arg_template) {
1033 log_error("--ephemeral and --template= may not be combined.");
1034 return -EINVAL;
1035 }
1036
1037 if (arg_ephemeral && arg_image) {
1038 log_error("--ephemeral and --image= may not be combined.");
1039 return -EINVAL;
1040 }
1041
df9a75e4
LP		 1042 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO)) {
1043 log_error("--ephemeral and --link-journal= may not be combined.");
1044 return -EINVAL;
1045 }
1046
4d9f07b4
LP		 1047 if (arg_volatile != VOLATILE_NO && arg_read_only) {
1048 log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
1049 return -EINVAL;
1050 }
1051
6d0b55c2
LP		 1052 if (arg_expose_ports && !arg_private_network) {
1053 log_error("Cannot use --port= without private networking.");
1054 return -EINVAL;
1055 }
1056
b774fb7f
DH		 1057 if (arg_userns && access("/proc/self/uid_map", F_OK) < 0)
1058 return log_error_errno(EOPNOTSUPP, "--private-users= is not supported, kernel compiled without user namespace support.");
1059
a42c8b54
LP		 1060 arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
1061
c6c8f6e2
LP		 1062 if (arg_boot && arg_kill_signal <= 0)
1063 arg_kill_signal = SIGRTMIN+3;
1064
efdb0237
LP		 1065 r = detect_unified_cgroup_hierarchy();
1066 if (r < 0)
1067 return r;
1068
88213476
LP		 1069 return 1;
1070}
1071
03cfe0d5
LP		 1072static int tmpfs_patch_options(const char *options, char **ret) {
1073 char *buf = NULL;
1074
1075 if (arg_userns && arg_uid_shift != 0) {
825d5287 1076 assert(arg_uid_shift != UID_INVALID);
03cfe0d5
LP		 1077
1078 if (options)
f001a835 1079 (void) asprintf(&buf, "%s,uid=" UID_FMT ",gid=" UID_FMT, options, arg_uid_shift, arg_uid_shift);
03cfe0d5 1080 else
f001a835 1081 (void) asprintf(&buf, "uid=" UID_FMT ",gid=" UID_FMT, arg_uid_shift, arg_uid_shift);
03cfe0d5
LP		 1082 if (!buf)
1083 return -ENOMEM;
1084
1085 options = buf;
1086 }
1087
1088#ifdef HAVE_SELINUX
1089 if (arg_selinux_apifs_context) {
1090 char *t;
1091
1092 if (options)
1093 t = strjoin(options, ",context=\"", arg_selinux_apifs_context, "\"", NULL);
1094 else
1095 t = strjoin("context=\"", arg_selinux_apifs_context, "\"", NULL);
1096 if (!t) {
1097 free(buf);
1098 return -ENOMEM;
1099 }
1100
1101 free(buf);
1102 buf = t;
1103 }
1104#endif
1105
1106 *ret = buf;
1107 return !!buf;
1108}
1109
1110static int mount_all(const char *dest, bool userns) {
88213476
LP		 1111
1112 typedef struct MountPoint {
1113 const char *what;
1114 const char *where;
1115 const char *type;
1116 const char *options;
1117 unsigned long flags;
3bd66c05 1118 bool fatal;
03cfe0d5 1119 bool userns;
88213476
LP		 1120 } MountPoint;
1121
1122 static const MountPoint mount_table[] = {
3c59d4f2
RM		 1123 { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true, true },
1124 { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, true, true }, /* Bind mount first */
1125 { NULL, "/proc/sys", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, true, true }, /* Then, make it r/o */
1126 { "sysfs", "/sys", "sysfs", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true, false },
3c59d4f2
RM		 1127 { "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME, true, false },
1128 { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true, false },
1129 { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true, false },
1130 { "tmpfs", "/tmp", "tmpfs", "mode=1777", MS_STRICTATIME, true, false },
9b634ea5 1131#ifdef HAVE_SELINUX
3c59d4f2
RM		 1132 { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, false, false }, /* Bind mount first */
1133 { NULL, "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, false, false }, /* Then, make it r/o */
9b634ea5 1134#endif
88213476
LP		 1135 };
1136
1137 unsigned k;
03cfe0d5 1138 int r;
88213476
LP		 1139
1140 for (k = 0; k < ELEMENTSOF(mount_table); k++) {
d15d65a0 1141 _cleanup_free_ char *where = NULL, *options = NULL;
d002827b 1142 const char *o;
88213476 1143
03cfe0d5
LP		 1144 if (userns != mount_table[k].userns)
1145 continue;
1146
1147 where = prefix_root(dest, mount_table[k].where);
17fe0523
LP		 1148 if (!where)
1149 return log_oom();
88213476 1150
e26d6ce5 1151 r = path_is_mount_point(where, AT_SYMLINK_FOLLOW);
03cfe0d5
LP		 1152 if (r < 0 && r != -ENOENT)
1153 return log_error_errno(r, "Failed to detect whether %s is a mount point: %m", where);
88213476 1154
9c1c7f71 1155 /* Skip this entry if it is not a remount. */
03cfe0d5 1156 if (mount_table[k].what && r > 0)
014a9c77
LP		 1157 continue;
1158
03cfe0d5
LP		 1159 r = mkdir_p(where, 0755);
1160 if (r < 0) {
1161 if (mount_table[k].fatal)
1162 return log_error_errno(r, "Failed to create directory %s: %m", where);
79d80fc1 1163
03cfe0d5 1164 log_warning_errno(r, "Failed to create directory %s: %m", where);
79d80fc1
TG		 1165 continue;
1166 }
88213476 1167
03cfe0d5
LP		 1168 o = mount_table[k].options;
1169 if (streq_ptr(mount_table[k].type, "tmpfs")) {
1170 r = tmpfs_patch_options(o, &options);
1171 if (r < 0)
6dac160c 1172 return log_oom();
03cfe0d5
LP		 1173 if (r > 0)
1174 o = options;
6dac160c 1175 }
a8828ed9 1176
88213476
LP		 1177 if (mount(mount_table[k].what,
1178 where,
1179 mount_table[k].type,
1180 mount_table[k].flags,
79d80fc1 1181 o) < 0) {
88213476 1182
03cfe0d5
LP		 1183 if (mount_table[k].fatal)
1184 return log_error_errno(errno, "mount(%s) failed: %m", where);
88213476 1185
03cfe0d5 1186 log_warning_errno(errno, "mount(%s) failed, ignoring: %m", where);
88213476 1187 }
88213476
LP		 1188 }
1189
03cfe0d5 1190 return 0;
e58a1277 1191}
f8440af5 1192
5e5bfa6e
EY		 1193static int parse_mount_bind_options(const char *options, unsigned long *mount_flags, char **mount_opts) {
1194 const char *p = options;
1195 unsigned long flags = *mount_flags;
1196 char *opts = NULL;
1197
1198 assert(options);
1199
1200 for (;;) {
1201 _cleanup_free_ char *word = NULL;
a19222e1 1202 int r = extract_first_word(&p, &word, ",", 0);
5e5bfa6e
EY		 1203 if (r < 0)
1204 return log_error_errno(r, "Failed to extract mount option: %m");
1205 if (r == 0)
1206 break;
1207
1208 if (streq(word, "rbind"))
1209 flags |= MS_REC;
1210 else if (streq(word, "norbind"))
1211 flags &= ~MS_REC;
1212 else {
1213 log_error("Invalid bind mount option: %s", word);
1214 return -EINVAL;
1215 }
1216 }
1217
1218 *mount_flags = flags;
1219 /* in the future mount_opts will hold string options for mount(2) */
1220 *mount_opts = opts;
1221
1222 return 0;
1223}
1224
5a8af538
LP		 1225static int mount_bind(const char *dest, CustomMount *m) {
1226 struct stat source_st, dest_st;
03cfe0d5 1227 const char *where;
5e5bfa6e
EY		 1228 unsigned long mount_flags = MS_BIND | MS_REC;
1229 _cleanup_free_ char *mount_opts = NULL;
5a8af538 1230 int r;
17fe0523 1231
5a8af538 1232 assert(m);
d2421337 1233
5e5bfa6e
EY		 1234 if (m->options) {
1235 r = parse_mount_bind_options(m->options, &mount_flags, &mount_opts);
1236 if (r < 0)
1237 return r;
1238 }
1239
5a8af538
LP		 1240 if (stat(m->source, &source_st) < 0)
1241 return log_error_errno(errno, "Failed to stat %s: %m", m->source);
17fe0523 1242
03cfe0d5 1243 where = prefix_roota(dest, m->destination);
06c17c39 1244
03cfe0d5 1245 if (stat(where, &dest_st) >= 0) {
5a8af538
LP		 1246 if (S_ISDIR(source_st.st_mode) && !S_ISDIR(dest_st.st_mode)) {
1247 log_error("Cannot bind mount directory %s on file %s.", m->source, where);
1248 return -EINVAL;
2ed4e5e0 1249 }
06c17c39 1250
5a8af538
LP		 1251 if (!S_ISDIR(source_st.st_mode) && S_ISDIR(dest_st.st_mode)) {
1252 log_error("Cannot bind mount file %s on directory %s.", m->source, where);
1253 return -EINVAL;
d2421337 1254 }
17fe0523 1255
5a8af538
LP		 1256 } else if (errno == ENOENT) {
1257 r = mkdir_parents_label(where, 0755);
1258 if (r < 0)
1259 return log_error_errno(r, "Failed to make parents of %s: %m", where);
1260 } else {
1261 log_error_errno(errno, "Failed to stat %s: %m", where);
1262 return -errno;
1263 }
17fe0523 1264
5a8af538
LP		 1265 /* Create the mount point. Any non-directory file can be
1266 * mounted on any non-directory file (regular, fifo, socket,
1267 * char, block).
1268 */
1269 if (S_ISDIR(source_st.st_mode))
1270 r = mkdir_label(where, 0755);
1271 else
1272 r = touch(where);
1273 if (r < 0 && r != -EEXIST)
1274 return log_error_errno(r, "Failed to create mount point %s: %m", where);
1275
5e5bfa6e 1276 if (mount(m->source, where, NULL, mount_flags, mount_opts) < 0)
5a8af538
LP		 1277 return log_error_errno(errno, "mount(%s) failed: %m", where);
1278
1279 if (m->read_only) {
1280 r = bind_remount_recursive(where, true);
1281 if (r < 0)
1282 return log_error_errno(r, "Read-only bind mount failed: %m");
1283 }
1284
1285 return 0;
1286}
1287
1288static int mount_tmpfs(const char *dest, CustomMount *m) {
03cfe0d5
LP		 1289 const char *where, *options;
1290 _cleanup_free_ char *buf = NULL;
5a8af538
LP		 1291 int r;
1292
1293 assert(dest);
1294 assert(m);
1295
03cfe0d5 1296 where = prefix_roota(dest, m->destination);
5a8af538 1297
03cfe0d5 1298 r = mkdir_p_label(where, 0755);
5a8af538
LP		 1299 if (r < 0 && r != -EEXIST)
1300 return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
1301
03cfe0d5
LP		 1302 r = tmpfs_patch_options(m->options, &buf);
1303 if (r < 0)
1304 return log_oom();
1305 options = r > 0 ? buf : m->options;
1306
1307 if (mount("tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, options) < 0)
5a8af538
LP		 1308 return log_error_errno(errno, "tmpfs mount to %s failed: %m", where);
1309
1310 return 0;
1311}
1312
872d0dbd
RM		 1313static char *joined_and_escaped_lower_dirs(char * const *lower) {
1314 _cleanup_strv_free_ char **sv = NULL;
1315
1316 sv = strv_copy(lower);
1317 if (!sv)
1318 return NULL;
1319
1320 strv_reverse(sv);
1321
1322 if (!strv_shell_escape(sv, ",:"))
1323 return NULL;
1324
1325 return strv_join(sv, ":");
1326}
1327
5a8af538
LP		 1328static int mount_overlay(const char *dest, CustomMount *m) {
1329 _cleanup_free_ char *lower = NULL;
03cfe0d5 1330 const char *where, *options;
5a8af538
LP		 1331 int r;
1332
1333 assert(dest);
1334 assert(m);
1335
03cfe0d5 1336 where = prefix_roota(dest, m->destination);
5a8af538
LP		 1337
1338 r = mkdir_label(where, 0755);
1339 if (r < 0 && r != -EEXIST)
1340 return log_error_errno(r, "Creating mount point for overlay %s failed: %m", where);
1341
1342 (void) mkdir_p_label(m->source, 0755);
1343
872d0dbd 1344 lower = joined_and_escaped_lower_dirs(m->lower);
5a8af538
LP		 1345 if (!lower)
1346 return log_oom();
1347
872d0dbd
RM		 1348 if (m->read_only) {
1349 _cleanup_free_ char *escaped_source = NULL;
1350
1351 escaped_source = shell_escape(m->source, ",:");
1352 if (!escaped_source)
1353 return log_oom();
1354
1355 options = strjoina("lowerdir=", escaped_source, ":", lower);
1356 } else {
1357 _cleanup_free_ char *escaped_source = NULL, *escaped_work_dir = NULL;
1358
5a8af538
LP		 1359 assert(m->work_dir);
1360 (void) mkdir_label(m->work_dir, 0700);
1361
872d0dbd
RM		 1362 escaped_source = shell_escape(m->source, ",:");
1363 if (!escaped_source)
1364 return log_oom();
1365 escaped_work_dir = shell_escape(m->work_dir, ",:");
1366 if (!escaped_work_dir)
1367 return log_oom();
1368
1369 options = strjoina("lowerdir=", lower, ",upperdir=", escaped_source, ",workdir=", escaped_work_dir);
5a8af538
LP		 1370 }
1371
1372 if (mount("overlay", where, "overlay", m->read_only ? MS_RDONLY : 0, options) < 0)
1373 return log_error_errno(errno, "overlay mount to %s failed: %m", where);
1374
1375 return 0;
1376}
1377
1378static int mount_custom(const char *dest) {
1379 unsigned i;
1380 int r;
1381
1382 assert(dest);
1383
1384 for (i = 0; i < arg_n_custom_mounts; i++) {
1385 CustomMount *m = &arg_custom_mounts[i];
1386
1387 switch (m->type) {
1388
1389 case CUSTOM_MOUNT_BIND:
1390 r = mount_bind(dest, m);
1391 break;
1392
1393 case CUSTOM_MOUNT_TMPFS:
1394 r = mount_tmpfs(dest, m);
1395 break;
1396
1397 case CUSTOM_MOUNT_OVERLAY:
1398 r = mount_overlay(dest, m);
1399 break;
1400
1401 default:
1402 assert_not_reached("Unknown custom mount type");
17fe0523 1403 }
5a8af538
LP		 1404
1405 if (r < 0)
1406 return r;
17fe0523
LP		 1407 }
1408
1409 return 0;
1410}
1411
efdb0237 1412static int mount_legacy_cgroup_hierarchy(const char *dest, const char *controller, const char *hierarchy, bool read_only) {
b12afc8c
LP		 1413 char *to;
1414 int r;
1415
63c372cb 1416 to = strjoina(dest, "/sys/fs/cgroup/", hierarchy);
b12afc8c 1417
e26d6ce5 1418 r = path_is_mount_point(to, 0);
da00518b 1419 if (r < 0 && r != -ENOENT)
b12afc8c
LP		 1420 return log_error_errno(r, "Failed to determine if %s is mounted already: %m", to);
1421 if (r > 0)
1422 return 0;
1423
1424 mkdir_p(to, 0755);
1425
c0534580
LP		 1426 /* The superblock mount options of the mount point need to be
1427 * identical to the hosts', and hence writable... */
1428 if (mount("cgroup", to, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV, controller) < 0)
b12afc8c
LP		 1429 return log_error_errno(errno, "Failed to mount to %s: %m", to);
1430
c0534580
LP		 1431 /* ... hence let's only make the bind mount read-only, not the
1432 * superblock. */
1433 if (read_only) {
1434 if (mount(NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0)
1435 return log_error_errno(errno, "Failed to remount %s read-only: %m", to);
1436 }
b12afc8c
LP		 1437 return 1;
1438}
1439
efdb0237 1440static int mount_legacy_cgroups(const char *dest) {
b12afc8c 1441 _cleanup_set_free_free_ Set *controllers = NULL;
03cfe0d5 1442 const char *cgroup_root;
b12afc8c
LP		 1443 int r;
1444
efdb0237
LP		 1445 cgroup_root = prefix_roota(dest, "/sys/fs/cgroup");
1446
1447 /* Mount a tmpfs to /sys/fs/cgroup if it's not mounted there yet. */
1448 r = path_is_mount_point(cgroup_root, AT_SYMLINK_FOLLOW);
1449 if (r < 0)
1450 return log_error_errno(r, "Failed to determine if /sys/fs/cgroup is already mounted: %m");
1451 if (r == 0) {
1452 _cleanup_free_ char *options = NULL;
1453
1454 r = tmpfs_patch_options("mode=755", &options);
1455 if (r < 0)
1456 return log_oom();
1457
1458 if (mount("tmpfs", cgroup_root, "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, options) < 0)
1459 return log_error_errno(errno, "Failed to mount /sys/fs/cgroup: %m");
1460 }
1461
1462 if (cg_unified() > 0)
1463 goto skip_controllers;
1464
b12afc8c
LP		 1465 controllers = set_new(&string_hash_ops);
1466 if (!controllers)
1467 return log_oom();
1468
1469 r = cg_kernel_controllers(controllers);
1470 if (r < 0)
1471 return log_error_errno(r, "Failed to determine cgroup controllers: %m");
1472
b12afc8c
LP		 1473 for (;;) {
1474 _cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL;
1475
1476 controller = set_steal_first(controllers);
1477 if (!controller)
1478 break;
1479
03cfe0d5 1480 origin = prefix_root("/sys/fs/cgroup/", controller);
b12afc8c
LP		 1481 if (!origin)
1482 return log_oom();
1483
1484 r = readlink_malloc(origin, &combined);
1485 if (r == -EINVAL) {
1486 /* Not a symbolic link, but directly a single cgroup hierarchy */
1487
efdb0237 1488 r = mount_legacy_cgroup_hierarchy(dest, controller, controller, true);
b12afc8c
LP		 1489 if (r < 0)
1490 return r;
1491
1492 } else if (r < 0)
1493 return log_error_errno(r, "Failed to read link %s: %m", origin);
1494 else {
1495 _cleanup_free_ char *target = NULL;
1496
03cfe0d5 1497 target = prefix_root(dest, origin);
b12afc8c
LP		 1498 if (!target)
1499 return log_oom();
1500
1501 /* A symbolic link, a combination of controllers in one hierarchy */
1502
1503 if (!filename_is_valid(combined)) {
1504 log_warning("Ignoring invalid combined hierarchy %s.", combined);
1505 continue;
1506 }
1507
efdb0237 1508 r = mount_legacy_cgroup_hierarchy(dest, combined, combined, true);
b12afc8c
LP		 1509 if (r < 0)
1510 return r;
1511
875e1014
ILG		 1512 r = symlink_idempotent(combined, target);
1513 if (r == -EINVAL) {
1514 log_error("Invalid existing symlink for combined hierarchy");
1515 return r;
1516 }
1517 if (r < 0)
1518 return log_error_errno(r, "Failed to create symlink for combined hierarchy: %m");
b12afc8c
LP		 1519 }
1520 }
1521
efdb0237
LP		 1522skip_controllers:
1523 r = mount_legacy_cgroup_hierarchy(dest, "none,name=systemd,xattr", "systemd", false);
b12afc8c
LP		 1524 if (r < 0)
1525 return r;
1526
03cfe0d5
LP		 1527 if (mount(NULL, cgroup_root, NULL, MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755") < 0)
1528 return log_error_errno(errno, "Failed to remount %s read-only: %m", cgroup_root);
1529
1530 return 0;
1531}
1532
efdb0237
LP		 1533static int mount_unified_cgroups(const char *dest) {
1534 const char *p;
1535 int r;
1536
1537 assert(dest);
1538
1539 p = strjoina(dest, "/sys/fs/cgroup");
1540
1541 r = path_is_mount_point(p, AT_SYMLINK_FOLLOW);
1542 if (r < 0)
1543 return log_error_errno(r, "Failed to determine if %s is mounted already: %m", p);
1544 if (r > 0) {
1545 p = strjoina(dest, "/sys/fs/cgroup/cgroup.procs");
1546 if (access(p, F_OK) >= 0)
1547 return 0;
1548 if (errno != ENOENT)
1549 return log_error_errno(errno, "Failed to determine if mount point %s contains the unified cgroup hierarchy: %m", p);
1550
1551 log_error("%s is already mounted but not a unified cgroup hierarchy. Refusing.", p);
1552 return -EINVAL;
1553 }
1554
1555 if (mount("cgroup", p, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV, "__DEVEL__sane_behavior") < 0)
1556 return log_error_errno(errno, "Failed to mount unified cgroup hierarchy to %s: %m", p);
1557
1558 return 0;
1559}
1560
1561static int mount_cgroups(const char *dest) {
1562 if (arg_unified_cgroup_hierarchy)
1563 return mount_unified_cgroups(dest);
1564 else
1565 return mount_legacy_cgroups(dest);
1566}
1567
03cfe0d5
LP		 1568static int mount_systemd_cgroup_writable(const char *dest) {
1569 _cleanup_free_ char *own_cgroup_path = NULL;
1570 const char *systemd_root, *systemd_own;
1571 int r;
1572
1573 assert(dest);
1574
1575 r = cg_pid_get_path(NULL, 0, &own_cgroup_path);
1576 if (r < 0)
1577 return log_error_errno(r, "Failed to determine our own cgroup path: %m");
1578
efdb0237
LP		 1579 /* If we are living in the top-level, then there's nothing to do... */
1580 if (path_equal(own_cgroup_path, "/"))
1581 return 0;
1582
1583 if (arg_unified_cgroup_hierarchy) {
1584 systemd_own = strjoina(dest, "/sys/fs/cgroup", own_cgroup_path);
1585 systemd_root = prefix_roota(dest, "/sys/fs/cgroup");
1586 } else {
1587 systemd_own = strjoina(dest, "/sys/fs/cgroup/systemd", own_cgroup_path);
1588 systemd_root = prefix_roota(dest, "/sys/fs/cgroup/systemd");
1589 }
1590
b12afc8c 1591 /* Make our own cgroup a (writable) bind mount */
b12afc8c
LP		 1592 if (mount(systemd_own, systemd_own, NULL, MS_BIND, NULL) < 0)
1593 return log_error_errno(errno, "Failed to turn %s into a bind mount: %m", own_cgroup_path);
1594
1595 /* And then remount the systemd cgroup root read-only */
b12afc8c
LP		 1596 if (mount(NULL, systemd_root, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0)
1597 return log_error_errno(errno, "Failed to mount cgroup root read-only: %m");
1598
03cfe0d5
LP		 1599 return 0;
1600}
1601
1602static int userns_lchown(const char *p, uid_t uid, gid_t gid) {
1603 assert(p);
1604
1605 if (!arg_userns)
1606 return 0;
1607
1608 if (uid == UID_INVALID && gid == GID_INVALID)
1609 return 0;
1610
1611 if (uid != UID_INVALID) {
1612 uid += arg_uid_shift;
1613
1614 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1615 return -EOVERFLOW;
1616 }
1617
1618 if (gid != GID_INVALID) {
1619 gid += (gid_t) arg_uid_shift;
1620
1621 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1622 return -EOVERFLOW;
1623 }
1624
1625 if (lchown(p, uid, gid) < 0)
1626 return -errno;
b12afc8c
LP		 1627
1628 return 0;
1629}
1630
03cfe0d5
LP		 1631static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
1632 const char *q;
1633
1634 q = prefix_roota(root, path);
1635 if (mkdir(q, mode) < 0) {
1636 if (errno == EEXIST)
1637 return 0;
1638 return -errno;
1639 }
1640
1641 return userns_lchown(q, uid, gid);
1642}
1643
e58a1277 1644static int setup_timezone(const char *dest) {
03cfe0d5
LP		 1645 _cleanup_free_ char *p = NULL, *q = NULL;
1646 const char *where, *check, *what;
d4036145
LP		 1647 char *z, *y;
1648 int r;
f8440af5 1649
e58a1277
LP		 1650 assert(dest);
1651
1652 /* Fix the timezone, if possible */
d4036145
LP		 1653 r = readlink_malloc("/etc/localtime", &p);
1654 if (r < 0) {
1655 log_warning("/etc/localtime is not a symlink, not updating container timezone.");
1656 return 0;
1657 }
1658
1659 z = path_startswith(p, "../usr/share/zoneinfo/");
1660 if (!z)
1661 z = path_startswith(p, "/usr/share/zoneinfo/");
1662 if (!z) {
1663 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
1664 return 0;
1665 }
1666
03cfe0d5 1667 where = prefix_roota(dest, "/etc/localtime");
d4036145
LP		 1668 r = readlink_malloc(where, &q);
1669 if (r >= 0) {
1670 y = path_startswith(q, "../usr/share/zoneinfo/");
1671 if (!y)
1672 y = path_startswith(q, "/usr/share/zoneinfo/");
4d1c38b8 1673
d4036145
LP		 1674 /* Already pointing to the right place? Then do nothing .. */
1675 if (y && streq(y, z))
1676 return 0;
1677 }
1678
03cfe0d5
LP		 1679 check = strjoina("/usr/share/zoneinfo/", z);
1680 check = prefix_root(dest, check);
1681 if (laccess(check, F_OK) < 0) {
d4036145
LP		 1682 log_warning("Timezone %s does not exist in container, not updating container timezone.", z);
1683 return 0;
1684 }
68fb0892 1685
79d80fc1
TG		 1686 r = unlink(where);
1687 if (r < 0 && errno != ENOENT) {
56f64d95 1688 log_error_errno(errno, "Failed to remove existing timezone info %s in container: %m", where);
79d80fc1
TG		 1689 return 0;
1690 }
4d9f07b4 1691
03cfe0d5 1692 what = strjoina("../usr/share/zoneinfo/", z);
d4036145 1693 if (symlink(what, where) < 0) {
56f64d95 1694 log_error_errno(errno, "Failed to correct timezone of container: %m");
d4036145
LP		 1695 return 0;
1696 }
e58a1277 1697
03cfe0d5
LP		 1698 r = userns_lchown(where, 0, 0);
1699 if (r < 0)
1700 return log_warning_errno(r, "Failed to chown /etc/localtime: %m");
1701
e58a1277 1702 return 0;
88213476
LP		 1703}
1704
2547bb41 1705static int setup_resolv_conf(const char *dest) {
03cfe0d5 1706 const char *where = NULL;
79d80fc1 1707 int r;
2547bb41
LP		 1708
1709 assert(dest);
1710
1711 if (arg_private_network)
1712 return 0;
1713
1714 /* Fix resolv.conf, if possible */
03cfe0d5 1715 where = prefix_roota(dest, "/etc/resolv.conf");
79d80fc1 1716
f2068bcc 1717 r = copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644, 0);
79d80fc1 1718 if (r < 0) {
68a313c5
LP		 1719 /* If the file already exists as symlink, let's
1720 * suppress the warning, under the assumption that
1721 * resolved or something similar runs inside and the
1722 * symlink points there.
1723 *
1724 * If the disk image is read-only, there's also no
1725 * point in complaining.
1726 */
1727 log_full_errno(IN_SET(r, -ELOOP, -EROFS) ? LOG_DEBUG : LOG_WARNING, r,
1728 "Failed to copy /etc/resolv.conf to %s: %m", where);
79d80fc1
TG		 1729 return 0;
1730 }
2547bb41 1731
03cfe0d5
LP		 1732 r = userns_lchown(where, 0, 0);
1733 if (r < 0)
1734 log_warning_errno(r, "Failed to chown /etc/resolv.conf: %m");
1735
2547bb41
LP		 1736 return 0;
1737}
1738
4d9f07b4 1739static int setup_volatile_state(const char *directory) {
03cfe0d5
LP		 1740 _cleanup_free_ char *buf = NULL;
1741 const char *p, *options;
4d9f07b4
LP		 1742 int r;
1743
1744 assert(directory);
1745
1746 if (arg_volatile != VOLATILE_STATE)
1747 return 0;
1748
1749 /* --volatile=state means we simply overmount /var
1750 with a tmpfs, and the rest read-only. */
1751
1752 r = bind_remount_recursive(directory, true);
f647962d
MS		 1753 if (r < 0)
1754 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
4d9f07b4 1755
03cfe0d5 1756 p = prefix_roota(directory, "/var");
79d80fc1 1757 r = mkdir(p, 0755);
4a62c710
MS		 1758 if (r < 0 && errno != EEXIST)
1759 return log_error_errno(errno, "Failed to create %s: %m", directory);
4d9f07b4 1760
03cfe0d5
LP		 1761 options = "mode=755";
1762 r = tmpfs_patch_options(options, &buf);
1763 if (r < 0)
1764 return log_oom();
1765 if (r > 0)
1766 options = buf;
1767
1768 if (mount("tmpfs", p, "tmpfs", MS_STRICTATIME, options) < 0)
4a62c710 1769 return log_error_errno(errno, "Failed to mount tmpfs to /var: %m");
4d9f07b4
LP		 1770
1771 return 0;
1772}
1773
1774static int setup_volatile(const char *directory) {
1775 bool tmpfs_mounted = false, bind_mounted = false;
1776 char template[] = "/tmp/nspawn-volatile-XXXXXX";
03cfe0d5
LP		 1777 _cleanup_free_ char *buf = NULL;
1778 const char *f, *t, *options;
4d9f07b4
LP		 1779 int r;
1780
1781 assert(directory);
1782
1783 if (arg_volatile != VOLATILE_YES)
1784 return 0;
1785
1786 /* --volatile=yes means we mount a tmpfs to the root dir, and
1787 the original /usr to use inside it, and that read-only. */
1788
4a62c710
MS		 1789 if (!mkdtemp(template))
1790 return log_error_errno(errno, "Failed to create temporary directory: %m");
4d9f07b4 1791
03cfe0d5
LP		 1792 options = "mode=755";
1793 r = tmpfs_patch_options(options, &buf);
1794 if (r < 0)
1795 return log_oom();
1796 if (r > 0)
1797 options = buf;
1798
1799 if (mount("tmpfs", template, "tmpfs", MS_STRICTATIME, options) < 0) {
1800 r = log_error_errno(errno, "Failed to mount tmpfs for root directory: %m");
4d9f07b4
LP		 1801 goto fail;
1802 }
1803
1804 tmpfs_mounted = true;
1805
03cfe0d5
LP		 1806 f = prefix_roota(directory, "/usr");
1807 t = prefix_roota(template, "/usr");
4d9f07b4 1808
79d80fc1
TG		 1809 r = mkdir(t, 0755);
1810 if (r < 0 && errno != EEXIST) {
03cfe0d5 1811 r = log_error_errno(errno, "Failed to create %s: %m", t);
79d80fc1
TG		 1812 goto fail;
1813 }
1814
4543768d 1815 if (mount(f, t, NULL, MS_BIND|MS_REC, NULL) < 0) {
03cfe0d5 1816 r = log_error_errno(errno, "Failed to create /usr bind mount: %m");
4d9f07b4
LP		 1817 goto fail;
1818 }
1819
1820 bind_mounted = true;
1821
1822 r = bind_remount_recursive(t, true);
1823 if (r < 0) {
da927ba9 1824 log_error_errno(r, "Failed to remount %s read-only: %m", t);
4d9f07b4
LP		 1825 goto fail;
1826 }
1827
1828 if (mount(template, directory, NULL, MS_MOVE, NULL) < 0) {
03cfe0d5 1829 r = log_error_errno(errno, "Failed to move root mount: %m");
4d9f07b4
LP		 1830 goto fail;
1831 }
1832
03cfe0d5 1833 (void) rmdir(template);
4d9f07b4
LP		 1834
1835 return 0;
1836
1837fail:
1838 if (bind_mounted)
03cfe0d5
LP		 1839 (void) umount(t);
1840
4d9f07b4 1841 if (tmpfs_mounted)
03cfe0d5
LP		 1842 (void) umount(template);
1843 (void) rmdir(template);
4d9f07b4
LP		 1844 return r;
1845}
1846
9f24adc2 1847static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
03cfe0d5 1848 assert(s);
9f24adc2
LP		 1849
1850 snprintf(s, 37,
1851 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1852 SD_ID128_FORMAT_VAL(id));
1853
1854 return s;
1855}
1856
04bc4a3f 1857static int setup_boot_id(const char *dest) {
03cfe0d5 1858 const char *from, *to;
39883f62 1859 sd_id128_t rnd = {};
04bc4a3f
LP		 1860 char as_uuid[37];
1861 int r;
1862
eb91eb18
LP		 1863 if (arg_share_system)
1864 return 0;
1865
04bc4a3f
LP		 1866 /* Generate a new randomized boot ID, so that each boot-up of
1867 * the container gets a new one */
1868
03cfe0d5
LP		 1869 from = prefix_roota(dest, "/run/proc-sys-kernel-random-boot-id");
1870 to = prefix_roota(dest, "/proc/sys/kernel/random/boot_id");
04bc4a3f
LP		 1871
1872 r = sd_id128_randomize(&rnd);
f647962d
MS		 1873 if (r < 0)
1874 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 1875
9f24adc2 1876 id128_format_as_uuid(rnd, as_uuid);
04bc4a3f 1877
4c1fc3e4 1878 r = write_string_file(from, as_uuid, WRITE_STRING_FILE_CREATE);
f647962d
MS		 1879 if (r < 0)
1880 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 1881
03cfe0d5
LP		 1882 if (mount(from, to, NULL, MS_BIND, NULL) < 0)
1883 r = log_error_errno(errno, "Failed to bind mount boot id: %m");
1884 else if (mount(NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL) < 0)
56f64d95 1885 log_warning_errno(errno, "Failed to make boot id read-only: %m");
04bc4a3f
LP		 1886
1887 unlink(from);
04bc4a3f
LP		 1888 return r;
1889}
1890
e58a1277 1891static int copy_devnodes(const char *dest) {
88213476
LP		 1892
1893 static const char devnodes[] =
1894 "null\0"
1895 "zero\0"
1896 "full\0"
1897 "random\0"
1898 "urandom\0"
85614d66
TG		 1899 "tty\0"
1900 "net/tun\0";
88213476
LP		 1901
1902 const char *d;
e58a1277 1903 int r = 0;
7fd1b19b 1904 _cleanup_umask_ mode_t u;
a258bf26
LP		 1905
1906 assert(dest);
124640f1
LP		 1907
1908 u = umask(0000);
88213476 1909
03cfe0d5
LP		 1910 /* Create /dev/net, so that we can create /dev/net/tun in it */
1911 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
1912 return log_error_errno(r, "Failed to create /dev/net directory: %m");
1913
88213476 1914 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 1915 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 1916 struct stat st;
88213476 1917
7f112f50 1918 from = strappend("/dev/", d);
03cfe0d5 1919 to = prefix_root(dest, from);
88213476
LP		 1920
1921 if (stat(from, &st) < 0) {
1922
4a62c710
MS		 1923 if (errno != ENOENT)
1924 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 1925
a258bf26 1926 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
88213476 1927
03cfe0d5 1928 log_error("%s is not a char or block device, cannot copy.", from);
7f112f50 1929 return -EIO;
a258bf26 1930
85614d66 1931 } else {
81f5049b
AC		 1932 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
1933 if (errno != EPERM)
1934 return log_error_errno(errno, "mknod(%s) failed: %m", to);
1935
1936 /* Some systems abusively restrict mknod but
1937 * allow bind mounts. */
1938 r = touch(to);
1939 if (r < 0)
1940 return log_error_errno(r, "touch (%s) failed: %m", to);
1941 if (mount(from, to, NULL, MS_BIND, NULL) < 0)
1942 return log_error_errno(errno, "Both mknod and bind mount (%s) failed: %m", to);
1943 }
6278cf60 1944
03cfe0d5
LP		 1945 r = userns_lchown(to, 0, 0);
1946 if (r < 0)
1947 return log_error_errno(r, "chown() of device node %s failed: %m", to);
88213476 1948 }
88213476
LP		 1949 }
1950
e58a1277
LP		 1951 return r;
1952}
88213476 1953
03cfe0d5
LP		 1954static int setup_pts(const char *dest) {
1955 _cleanup_free_ char *options = NULL;
1956 const char *p;
1957
1958#ifdef HAVE_SELINUX
1959 if (arg_selinux_apifs_context)
1960 (void) asprintf(&options,
3dce8915 1961 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 1962 arg_uid_shift + TTY_GID,
1963 arg_selinux_apifs_context);
1964 else
1965#endif
1966 (void) asprintf(&options,
3dce8915 1967 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 1968 arg_uid_shift + TTY_GID);
f2d88580 1969
03cfe0d5 1970 if (!options)
f2d88580
LP		 1971 return log_oom();
1972
03cfe0d5 1973 /* Mount /dev/pts itself */
cc9fce65 1974 p = prefix_roota(dest, "/dev/pts");
03cfe0d5
LP		 1975 if (mkdir(p, 0755) < 0)
1976 return log_error_errno(errno, "Failed to create /dev/pts: %m");
1977 if (mount("devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options) < 0)
1978 return log_error_errno(errno, "Failed to mount /dev/pts: %m");
1979 if (userns_lchown(p, 0, 0) < 0)
1980 return log_error_errno(errno, "Failed to chown /dev/pts: %m");
1981
1982 /* Create /dev/ptmx symlink */
1983 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 1984 if (symlink("pts/ptmx", p) < 0)
1985 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
03cfe0d5
LP		 1986 if (userns_lchown(p, 0, 0) < 0)
1987 return log_error_errno(errno, "Failed to chown /dev/ptmx: %m");
f2d88580 1988
03cfe0d5
LP		 1989 /* And fix /dev/pts/ptmx ownership */
1990 p = prefix_roota(dest, "/dev/pts/ptmx");
1991 if (userns_lchown(p, 0, 0) < 0)
1992 return log_error_errno(errno, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 1993
f2d88580
LP		 1994 return 0;
1995}
1996
e58a1277 1997static int setup_dev_console(const char *dest, const char *console) {
eb0f0863
LP		 1998 _cleanup_umask_ mode_t u;
1999 const char *to;
e58a1277 2000 int r;
e58a1277
LP		 2001
2002 assert(dest);
2003 assert(console);
2004
2005 u = umask(0000);
2006
03cfe0d5 2007 r = chmod_and_chown(console, 0600, arg_uid_shift, arg_uid_shift);
f647962d
MS		 2008 if (r < 0)
2009 return log_error_errno(r, "Failed to correct access mode for TTY: %m");
88213476 2010
a258bf26
LP		 2011 /* We need to bind mount the right tty to /dev/console since
2012 * ptys can only exist on pts file systems. To have something
81f5049b 2013 * to bind mount things on we create a empty regular file. */
a258bf26 2014
03cfe0d5 2015 to = prefix_roota(dest, "/dev/console");
81f5049b
AC		 2016 r = touch(to);
2017 if (r < 0)
2018 return log_error_errno(r, "touch() for /dev/console failed: %m");
a258bf26 2019
4543768d 2020 if (mount(console, to, NULL, MS_BIND, NULL) < 0)
4a62c710 2021 return log_error_errno(errno, "Bind mount for /dev/console failed: %m");
a258bf26 2022
25ea79fe 2023 return 0;
e58a1277
LP		 2024}
2025
2026static int setup_kmsg(const char *dest, int kmsg_socket) {
03cfe0d5 2027 const char *from, *to;
7fd1b19b 2028 _cleanup_umask_ mode_t u;
03cfe0d5 2029 int fd, k;
e58a1277
LP		 2030 union {
2031 struct cmsghdr cmsghdr;
2032 uint8_t buf[CMSG_SPACE(sizeof(int))];
b92bea5d
ZJS		 2033 } control = {};
2034 struct msghdr mh = {
2035 .msg_control = &control,
2036 .msg_controllen = sizeof(control),
2037 };
e58a1277
LP		 2038 struct cmsghdr *cmsg;
2039
e58a1277 2040 assert(kmsg_socket >= 0);
a258bf26 2041
e58a1277 2042 u = umask(0000);
a258bf26 2043
03cfe0d5 2044 /* We create the kmsg FIFO as /run/kmsg, but immediately
f1e5dfe2
LP		 2045 * delete it after bind mounting it to /proc/kmsg. While FIFOs
2046 * on the reading side behave very similar to /proc/kmsg,
2047 * their writing side behaves differently from /dev/kmsg in
2048 * that writing blocks when nothing is reading. In order to
2049 * avoid any problems with containers deadlocking due to this
2050 * we simply make /dev/kmsg unavailable to the container. */
03cfe0d5
LP		 2051 from = prefix_roota(dest, "/run/kmsg");
2052 to = prefix_roota(dest, "/proc/kmsg");
e58a1277 2053
4a62c710 2054 if (mkfifo(from, 0600) < 0)
03cfe0d5 2055 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
4543768d 2056 if (mount(from, to, NULL, MS_BIND, NULL) < 0)
4a62c710 2057 return log_error_errno(errno, "Bind mount for /proc/kmsg failed: %m");
e58a1277
LP		 2058
2059 fd = open(from, O_RDWR|O_NDELAY|O_CLOEXEC);
4a62c710
MS		 2060 if (fd < 0)
2061 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 2062
e58a1277
LP		 2063 cmsg = CMSG_FIRSTHDR(&mh);
2064 cmsg->cmsg_level = SOL_SOCKET;
2065 cmsg->cmsg_type = SCM_RIGHTS;
2066 cmsg->cmsg_len = CMSG_LEN(sizeof(int));
2067 memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
2068
2069 mh.msg_controllen = cmsg->cmsg_len;
2070
2071 /* Store away the fd in the socket, so that it stays open as
2072 * long as we run the child */
6d0b55c2 2073 k = sendmsg(kmsg_socket, &mh, MSG_NOSIGNAL);
03e334a1 2074 safe_close(fd);
e58a1277 2075
4a62c710
MS		 2076 if (k < 0)
2077 return log_error_errno(errno, "Failed to send FIFO fd: %m");
a258bf26 2078
03cfe0d5
LP		 2079 /* And now make the FIFO unavailable as /run/kmsg... */
2080 (void) unlink(from);
2081
25ea79fe 2082 return 0;
88213476
LP		 2083}
2084
6d0b55c2
LP		 2085static int send_rtnl(int send_fd) {
2086 union {
2087 struct cmsghdr cmsghdr;
2088 uint8_t buf[CMSG_SPACE(sizeof(int))];
2089 } control = {};
2090 struct msghdr mh = {
2091 .msg_control = &control,
2092 .msg_controllen = sizeof(control),
2093 };
2094 struct cmsghdr *cmsg;
2095 _cleanup_close_ int fd = -1;
2096 ssize_t k;
2097
2098 assert(send_fd >= 0);
2099
2100 if (!arg_expose_ports)
2101 return 0;
2102
2103 fd = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_ROUTE);
2104 if (fd < 0)
03cfe0d5 2105 return log_error_errno(errno, "Failed to allocate container netlink: %m");
6d0b55c2
LP		 2106
2107 cmsg = CMSG_FIRSTHDR(&mh);
2108 cmsg->cmsg_level = SOL_SOCKET;
2109 cmsg->cmsg_type = SCM_RIGHTS;
2110 cmsg->cmsg_len = CMSG_LEN(sizeof(int));
2111 memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
2112
2113 mh.msg_controllen = cmsg->cmsg_len;
2114
2115 /* Store away the fd in the socket, so that it stays open as
2116 * long as we run the child */
2117 k = sendmsg(send_fd, &mh, MSG_NOSIGNAL);
2118 if (k < 0)
2119 return log_error_errno(errno, "Failed to send netlink fd: %m");
2120
2121 return 0;
2122}
2123
2124static int flush_ports(union in_addr_union *exposed) {
2125 ExposePort *p;
2126 int r, af = AF_INET;
2127
2128 assert(exposed);
2129
2130 if (!arg_expose_ports)
2131 return 0;
2132
2133 if (in_addr_is_null(af, exposed))
2134 return 0;
2135
2136 log_debug("Lost IP address.");
2137
2138 LIST_FOREACH(ports, p, arg_expose_ports) {
2139 r = fw_add_local_dnat(false,
2140 af,
2141 p->protocol,
2142 NULL,
2143 NULL, 0,
2144 NULL, 0,
2145 p->host_port,
2146 exposed,
2147 p->container_port,
2148 NULL);
2149 if (r < 0)
2150 log_warning_errno(r, "Failed to modify firewall: %m");
2151 }
2152
2153 *exposed = IN_ADDR_NULL;
2154 return 0;
2155}
2156
1c4baffc 2157static int expose_ports(sd_netlink *rtnl, union in_addr_union *exposed) {
6d0b55c2
LP		 2158 _cleanup_free_ struct local_address *addresses = NULL;
2159 _cleanup_free_ char *pretty = NULL;
2160 union in_addr_union new_exposed;
2161 ExposePort *p;
2162 bool add;
2163 int af = AF_INET, r;
2164
2165 assert(exposed);
2166
2167 /* Invoked each time an address is added or removed inside the
2168 * container */
2169
2170 if (!arg_expose_ports)
2171 return 0;
2172
2173 r = local_addresses(rtnl, 0, af, &addresses);
2174 if (r < 0)
2175 return log_error_errno(r, "Failed to enumerate local addresses: %m");
2176
2177 add = r > 0 &&
2178 addresses[0].family == af &&
2179 addresses[0].scope < RT_SCOPE_LINK;
2180
2181 if (!add)
2182 return flush_ports(exposed);
2183
2184 new_exposed = addresses[0].address;
2185 if (in_addr_equal(af, exposed, &new_exposed))
2186 return 0;
2187
2188 in_addr_to_string(af, &new_exposed, &pretty);
2189 log_debug("New container IP is %s.", strna(pretty));
2190
2191 LIST_FOREACH(ports, p, arg_expose_ports) {
2192
2193 r = fw_add_local_dnat(true,
2194 af,
2195 p->protocol,
2196 NULL,
2197 NULL, 0,
2198 NULL, 0,
2199 p->host_port,
2200 &new_exposed,
2201 p->container_port,
2202 in_addr_is_null(af, exposed) ? NULL : exposed);
2203 if (r < 0)
2204 log_warning_errno(r, "Failed to modify firewall: %m");
2205 }
2206
2207 *exposed = new_exposed;
2208 return 0;
2209}
2210
1c4baffc 2211static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
6d0b55c2
LP		 2212 union in_addr_union *exposed = userdata;
2213
2214 assert(rtnl);
2215 assert(m);
2216 assert(exposed);
2217
2218 expose_ports(rtnl, exposed);
2219 return 0;
2220}
2221
1c4baffc 2222static int watch_rtnl(sd_event *event, int recv_fd, union in_addr_union *exposed, sd_netlink **ret) {
6d0b55c2
LP		 2223 union {
2224 struct cmsghdr cmsghdr;
2225 uint8_t buf[CMSG_SPACE(sizeof(int))];
2226 } control = {};
2227 struct msghdr mh = {
2228 .msg_control = &control,
2229 .msg_controllen = sizeof(control),
2230 };
2231 struct cmsghdr *cmsg;
1c4baffc 2232 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
6d0b55c2
LP		 2233 int fd, r;
2234 ssize_t k;
2235
2236 assert(event);
2237 assert(recv_fd >= 0);
2238 assert(ret);
2239
2240 if (!arg_expose_ports)
2241 return 0;
2242
2243 k = recvmsg(recv_fd, &mh, MSG_NOSIGNAL);
2244 if (k < 0)
2245 return log_error_errno(errno, "Failed to recv netlink fd: %m");
2246
2247 cmsg = CMSG_FIRSTHDR(&mh);
2248 assert(cmsg->cmsg_level == SOL_SOCKET);
2249 assert(cmsg->cmsg_type == SCM_RIGHTS);
657bdca9 2250 assert(cmsg->cmsg_len == CMSG_LEN(sizeof(int)));
6d0b55c2
LP		 2251 memcpy(&fd, CMSG_DATA(cmsg), sizeof(int));
2252
1c4baffc 2253 r = sd_netlink_open_fd(&rtnl, fd);
6d0b55c2
LP		 2254 if (r < 0) {
2255 safe_close(fd);
2256 return log_error_errno(r, "Failed to create rtnl object: %m");
2257 }
2258
1c4baffc 2259 r = sd_netlink_add_match(rtnl, RTM_NEWADDR, on_address_change, exposed);
6d0b55c2
LP		 2260 if (r < 0)
2261 return log_error_errno(r, "Failed to subscribe to RTM_NEWADDR messages: %m");
2262
1c4baffc 2263 r = sd_netlink_add_match(rtnl, RTM_DELADDR, on_address_change, exposed);
6d0b55c2
LP		 2264 if (r < 0)
2265 return log_error_errno(r, "Failed to subscribe to RTM_DELADDR messages: %m");
2266
1c4baffc 2267 r = sd_netlink_attach_event(rtnl, event, 0);
6d0b55c2
LP		 2268 if (r < 0)
2269 return log_error_errno(r, "Failed to add to even loop: %m");
2270
2271 *ret = rtnl;
2272 rtnl = NULL;
2273
2274 return 0;
2275}
2276
3a74cea5 2277static int setup_hostname(void) {
3a74cea5 2278
eb91eb18
LP		 2279 if (arg_share_system)
2280 return 0;
2281
605f81a8 2282 if (sethostname_idempotent(arg_machine) < 0)
7027ff61 2283 return -errno;
3a74cea5 2284
7027ff61 2285 return 0;
3a74cea5
LP		 2286}
2287
57fb9fb5 2288static int setup_journal(const char *directory) {
4d680aee 2289 sd_id128_t machine_id, this_id;
03cfe0d5
LP		 2290 _cleanup_free_ char *b = NULL, *d = NULL;
2291 const char *etc_machine_id, *p, *q;
27407a01 2292 char *id;
57fb9fb5
LP		 2293 int r;
2294
df9a75e4
LP		 2295 /* Don't link journals in ephemeral mode */
2296 if (arg_ephemeral)
2297 return 0;
2298
03cfe0d5 2299 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
57fb9fb5 2300
03cfe0d5 2301 r = read_one_line_file(etc_machine_id, &b);
27407a01
ZJS		 2302 if (r == -ENOENT && arg_link_journal == LINK_AUTO)
2303 return 0;
f647962d 2304 else if (r < 0)
03cfe0d5 2305 return log_error_errno(r, "Failed to read machine ID from %s: %m", etc_machine_id);
57fb9fb5 2306
27407a01
ZJS		 2307 id = strstrip(b);
2308 if (isempty(id) && arg_link_journal == LINK_AUTO)
2309 return 0;
57fb9fb5 2310
27407a01
ZJS		 2311 /* Verify validity */
2312 r = sd_id128_from_string(id, &machine_id);
f647962d 2313 if (r < 0)
03cfe0d5 2314 return log_error_errno(r, "Failed to parse machine ID from %s: %m", etc_machine_id);
57fb9fb5 2315
4d680aee 2316 r = sd_id128_get_machine(&this_id);
f647962d
MS		 2317 if (r < 0)
2318 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee
ZJS		 2319
2320 if (sd_id128_equal(machine_id, this_id)) {
2321 log_full(arg_link_journal == LINK_AUTO ? LOG_WARNING : LOG_ERR,
2322 "Host and machine ids are equal (%s): refusing to link journals", id);
2323 if (arg_link_journal == LINK_AUTO)
2324 return 0;
df9a75e4 2325 return -EEXIST;
4d680aee
ZJS		 2326 }
2327
2328 if (arg_link_journal == LINK_NO)
2329 return 0;
2330
03cfe0d5
LP		 2331 r = userns_mkdir(directory, "/var", 0755, 0, 0);
2332 if (r < 0)
2333 return log_error_errno(r, "Failed to create /var: %m");
2334
2335 r = userns_mkdir(directory, "/var/log", 0755, 0, 0);
2336 if (r < 0)
2337 return log_error_errno(r, "Failed to create /var/log: %m");
2338
2339 r = userns_mkdir(directory, "/var/log/journal", 0755, 0, 0);
2340 if (r < 0)
2341 return log_error_errno(r, "Failed to create /var/log/journal: %m");
2342
2343 p = strjoina("/var/log/journal/", id);
2344 q = prefix_roota(directory, p);
27407a01 2345
e26d6ce5 2346 if (path_is_mount_point(p, 0) > 0) {
27407a01
ZJS		 2347 if (arg_link_journal != LINK_AUTO) {
2348 log_error("%s: already a mount point, refusing to use for journal", p);
2349 return -EEXIST;
2350 }
2351
2352 return 0;
57fb9fb5
LP		 2353 }
2354
e26d6ce5 2355 if (path_is_mount_point(q, 0) > 0) {
57fb9fb5 2356 if (arg_link_journal != LINK_AUTO) {
27407a01
ZJS		 2357 log_error("%s: already a mount point, refusing to use for journal", q);
2358 return -EEXIST;
57fb9fb5
LP		 2359 }
2360
27407a01 2361 return 0;
57fb9fb5
LP		 2362 }
2363
2364 r = readlink_and_make_absolute(p, &d);
2365 if (r >= 0) {
2366 if ((arg_link_journal == LINK_GUEST ||
2367 arg_link_journal == LINK_AUTO) &&
2368 path_equal(d, q)) {
2369
03cfe0d5 2370 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2371 if (r < 0)
56f64d95 2372 log_warning_errno(errno, "Failed to create directory %s: %m", q);
27407a01 2373 return 0;
57fb9fb5
LP		 2374 }
2375
4a62c710
MS		 2376 if (unlink(p) < 0)
2377 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 2378 } else if (r == -EINVAL) {
2379
2380 if (arg_link_journal == LINK_GUEST &&
2381 rmdir(p) < 0) {
2382
27407a01
ZJS		 2383 if (errno == ENOTDIR) {
2384 log_error("%s already exists and is neither a symlink nor a directory", p);
2385 return r;
2386 } else {
56f64d95 2387 log_error_errno(errno, "Failed to remove %s: %m", p);
27407a01 2388 return -errno;
57fb9fb5 2389 }
57fb9fb5
LP		 2390 }
2391 } else if (r != -ENOENT) {
56f64d95 2392 log_error_errno(errno, "readlink(%s) failed: %m", p);
27407a01 2393 return r;
57fb9fb5
LP		 2394 }
2395
2396 if (arg_link_journal == LINK_GUEST) {
2397
2398 if (symlink(q, p) < 0) {
574edc90 2399 if (arg_link_journal_try) {
56f64d95 2400 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90
MP		 2401 return 0;
2402 } else {
56f64d95 2403 log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
574edc90
MP		 2404 return -errno;
2405 }
57fb9fb5
LP		 2406 }
2407
03cfe0d5 2408 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2409 if (r < 0)
56f64d95 2410 log_warning_errno(errno, "Failed to create directory %s: %m", q);
27407a01 2411 return 0;
57fb9fb5
LP		 2412 }
2413
2414 if (arg_link_journal == LINK_HOST) {
574edc90
MP		 2415 /* don't create parents here -- if the host doesn't have
2416 * permanent journal set up, don't force it here */
2417 r = mkdir(p, 0755);
57fb9fb5 2418 if (r < 0) {
574edc90 2419 if (arg_link_journal_try) {
56f64d95 2420 log_debug_errno(errno, "Failed to create %s, skipping journal setup: %m", p);
574edc90
MP		 2421 return 0;
2422 } else {
56f64d95 2423 log_error_errno(errno, "Failed to create %s: %m", p);
574edc90
MP		 2424 return r;
2425 }
57fb9fb5
LP		 2426 }
2427
27407a01
ZJS		 2428 } else if (access(p, F_OK) < 0)
2429 return 0;
57fb9fb5 2430
cdb2b9d0
LP		 2431 if (dir_is_empty(q) == 0)
2432 log_warning("%s is not empty, proceeding anyway.", q);
2433
03cfe0d5 2434 r = userns_mkdir(directory, p, 0755, 0, 0);
57fb9fb5 2435 if (r < 0) {
56f64d95 2436 log_error_errno(errno, "Failed to create %s: %m", q);
27407a01 2437 return r;
57fb9fb5
LP		 2438 }
2439
4543768d 2440 if (mount(p, q, NULL, MS_BIND, NULL) < 0)
4a62c710 2441 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 2442
27407a01 2443 return 0;
57fb9fb5
LP		 2444}
2445
88213476 2446static int drop_capabilities(void) {
5076f0cc 2447 return capability_bounding_set_drop(~arg_retain, false);
88213476
LP		 2448}
2449
5aa4bb6b 2450static int register_machine(pid_t pid, int local_ifindex) {
9444b1f2 2451 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
03976f7b 2452 _cleanup_bus_flush_close_unref_ sd_bus *bus = NULL;
9444b1f2
LP		 2453 int r;
2454
eb91eb18
LP		 2455 if (!arg_register)
2456 return 0;
2457
1c03020c 2458 r = sd_bus_default_system(&bus);
f647962d
MS		 2459 if (r < 0)
2460 return log_error_errno(r, "Failed to open system bus: %m");
9444b1f2 2461
89f7c846
LP		 2462 if (arg_keep_unit) {
2463 r = sd_bus_call_method(
2464 bus,
2465 "org.freedesktop.machine1",
2466 "/org/freedesktop/machine1",
2467 "org.freedesktop.machine1.Manager",
5aa4bb6b 2468 "RegisterMachineWithNetwork",
89f7c846
LP		 2469 &error,
2470 NULL,
5aa4bb6b 2471 "sayssusai",
89f7c846
LP		 2472 arg_machine,
2473 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
2474 "nspawn",
2475 "container",
2476 (uint32_t) pid,
5aa4bb6b
LP		 2477 strempty(arg_directory),
2478 local_ifindex > 0 ? 1 : 0, local_ifindex);
89f7c846 2479 } else {
9457ac5b 2480 _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
f36933fe 2481 char **i;
ce5b3ad4 2482 unsigned j;
9457ac5b
LP		 2483
2484 r = sd_bus_message_new_method_call(
89f7c846 2485 bus,
9457ac5b 2486 &m,
89f7c846
LP		 2487 "org.freedesktop.machine1",
2488 "/org/freedesktop/machine1",
2489 "org.freedesktop.machine1.Manager",
5aa4bb6b 2490 "CreateMachineWithNetwork");
f647962d 2491 if (r < 0)
f36933fe 2492 return bus_log_create_error(r);
9457ac5b
LP		 2493
2494 r = sd_bus_message_append(
2495 m,
5aa4bb6b 2496 "sayssusai",
89f7c846
LP		 2497 arg_machine,
2498 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
2499 "nspawn",
2500 "container",
2501 (uint32_t) pid,
5aa4bb6b
LP		 2502 strempty(arg_directory),
2503 local_ifindex > 0 ? 1 : 0, local_ifindex);
f647962d 2504 if (r < 0)
f36933fe 2505 return bus_log_create_error(r);
9457ac5b
LP		 2506
2507 r = sd_bus_message_open_container(m, 'a', "(sv)");
f647962d 2508 if (r < 0)
f36933fe 2509 return bus_log_create_error(r);
9457ac5b
LP		 2510
2511 if (!isempty(arg_slice)) {
2512 r = sd_bus_message_append(m, "(sv)", "Slice", "s", arg_slice);
f647962d 2513 if (r < 0)
f36933fe 2514 return bus_log_create_error(r);
9457ac5b
LP		 2515 }
2516
2517 r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict");
f647962d 2518 if (r < 0)
f36933fe 2519 return bus_log_create_error(r);
9457ac5b 2520
773ce3d8
LP		 2521 /* If you make changes here, also make sure to update
2522 * systemd-nspawn@.service, to keep the device
2523 * policies in sync regardless if we are run with or
2524 * without the --keep-unit switch. */
63cc4c31 2525 r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 9,
9457ac5b
LP		 2526 /* Allow the container to
2527 * access and create the API
2528 * device nodes, so that
2529 * PrivateDevices= in the
2530 * container can work
2531 * fine */
2532 "/dev/null", "rwm",
2533 "/dev/zero", "rwm",
2534 "/dev/full", "rwm",
2535 "/dev/random", "rwm",
2536 "/dev/urandom", "rwm",
2537 "/dev/tty", "rwm",
864e1706 2538 "/dev/net/tun", "rwm",
9457ac5b
LP		 2539 /* Allow the container
2540 * access to ptys. However,
2541 * do not permit the
2542 * container to ever create
2543 * these device nodes. */
2544 "/dev/pts/ptmx", "rw",
63cc4c31 2545 "char-pts", "rw");
f647962d 2546 if (r < 0)
27023c0e
LP		 2547 return bus_log_create_error(r);
2548
ce5b3ad4
SJ		 2549 for (j = 0; j < arg_n_custom_mounts; j++) {
2550 CustomMount *cm = &arg_custom_mounts[j];
2551
2552 if (cm->type != CUSTOM_MOUNT_BIND)
2553 continue;
2554
2555 r = is_device_node(cm->source);
2556 if (r < 0)
2557 return log_error_errno(r, "Failed to stat %s: %m", cm->source);
2558
2559 if (r) {
2560 r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 1,
2561 cm->source, cm->read_only ? "r" : "rw");
2562 if (r < 0)
2563 return log_error_errno(r, "Failed to append message arguments: %m");
2564 }
2565 }
2566
27023c0e
LP		 2567 if (arg_kill_signal != 0) {
2568 r = sd_bus_message_append(m, "(sv)", "KillSignal", "i", arg_kill_signal);
2569 if (r < 0)
2570 return bus_log_create_error(r);
2571
2572 r = sd_bus_message_append(m, "(sv)", "KillMode", "s", "mixed");
2573 if (r < 0)
2574 return bus_log_create_error(r);
2575 }
9457ac5b 2576
f36933fe
LP		 2577 STRV_FOREACH(i, arg_property) {
2578 r = sd_bus_message_open_container(m, 'r', "sv");
2579 if (r < 0)
2580 return bus_log_create_error(r);
2581
2582 r = bus_append_unit_property_assignment(m, *i);
2583 if (r < 0)
2584 return r;
2585
2586 r = sd_bus_message_close_container(m);
2587 if (r < 0)
2588 return bus_log_create_error(r);
2589 }
2590
9457ac5b 2591 r = sd_bus_message_close_container(m);
f647962d 2592 if (r < 0)
f36933fe 2593 return bus_log_create_error(r);
9457ac5b
LP		 2594
2595 r = sd_bus_call(bus, m, 0, &error, NULL);
89f7c846
LP		 2596 }
2597
9444b1f2 2598 if (r < 0) {
1f0cd86b
LP		 2599 log_error("Failed to register machine: %s", bus_error_message(&error, r));
2600 return r;
2601 }
2602
2603 return 0;
2604}
2605
2606static int terminate_machine(pid_t pid) {
2607 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
2608 _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
03976f7b 2609 _cleanup_bus_flush_close_unref_ sd_bus *bus = NULL;
1f0cd86b
LP		 2610 const char *path;
2611 int r;
2612
eb91eb18
LP		 2613 if (!arg_register)
2614 return 0;
2615
1a2399e5
LP		 2616 /* If we are reusing the unit, then just exit, systemd will do
2617 * the right thing when we exit. */
2618 if (arg_keep_unit)
2619 return 0;
2620
76b54375 2621 r = sd_bus_default_system(&bus);
f647962d
MS		 2622 if (r < 0)
2623 return log_error_errno(r, "Failed to open system bus: %m");
1f0cd86b
LP		 2624
2625 r = sd_bus_call_method(
2626 bus,
2627 "org.freedesktop.machine1",
2628 "/org/freedesktop/machine1",
2629 "org.freedesktop.machine1.Manager",
2630 "GetMachineByPID",
2631 &error,
2632 &reply,
2633 "u",
2634 (uint32_t) pid);
2635 if (r < 0) {
2636 /* Note that the machine might already have been
2637 * cleaned up automatically, hence don't consider it a
2638 * failure if we cannot get the machine object. */
2639 log_debug("Failed to get machine: %s", bus_error_message(&error, r));
2640 return 0;
2641 }
2642
2643 r = sd_bus_message_read(reply, "o", &path);
5b30bef8
LP		 2644 if (r < 0)
2645 return bus_log_parse_error(r);
9444b1f2 2646
1f0cd86b
LP		 2647 r = sd_bus_call_method(
2648 bus,
2649 "org.freedesktop.machine1",
2650 path,
2651 "org.freedesktop.machine1.Machine",
2652 "Terminate",
2653 &error,
2654 NULL,
2655 NULL);
2656 if (r < 0) {
2657 log_debug("Failed to terminate machine: %s", bus_error_message(&error, r));
2658 return 0;
2659 }
2660
9444b1f2
LP		 2661 return 0;
2662}
2663
db999e0f
LP		 2664static int reset_audit_loginuid(void) {
2665 _cleanup_free_ char *p = NULL;
2666 int r;
2667
2668 if (arg_share_system)
2669 return 0;
2670
2671 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 2672 if (r == -ENOENT)
db999e0f 2673 return 0;
f647962d
MS		 2674 if (r < 0)
2675 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 2676
2677 /* Already reset? */
2678 if (streq(p, "4294967295"))
2679 return 0;
2680
ad118bda 2681 r = write_string_file("/proc/self/loginuid", "4294967295", 0);
db999e0f 2682 if (r < 0) {
10a87006
LP		 2683 log_error_errno(r,
2684 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2685 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2686 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2687 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2688 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 2689
db999e0f 2690 sleep(5);
77b6e194 2691 }
db999e0f
LP		 2692
2693 return 0;
77b6e194
LP		 2694}
2695
4f758c23
LP		 2696#define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
2697#define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
e867ceb6 2698#define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
01dde061 2699
a90e2305 2700static int generate_mac(struct ether_addr *mac, sd_id128_t hash_key, uint64_t idx) {
01dde061
TG		 2701 uint8_t result[8];
2702 size_t l, sz;
a90e2305
LP		 2703 uint8_t *v, *i;
2704 int r;
01dde061
TG		 2705
2706 l = strlen(arg_machine);
2707 sz = sizeof(sd_id128_t) + l;
e867ceb6
LP		 2708 if (idx > 0)
2709 sz += sizeof(idx);
a90e2305 2710
01dde061
TG		 2711 v = alloca(sz);
2712
2713 /* fetch some persistent data unique to the host */
2714 r = sd_id128_get_machine((sd_id128_t*) v);
2715 if (r < 0)
2716 return r;
2717
2718 /* combine with some data unique (on this host) to this
2719 * container instance */
a90e2305
LP		 2720 i = mempcpy(v + sizeof(sd_id128_t), arg_machine, l);
2721 if (idx > 0) {
2722 idx = htole64(idx);
2723 memcpy(i, &idx, sizeof(idx));
2724 }
01dde061
TG		 2725
2726 /* Let's hash the host machine ID plus the container name. We
2727 * use a fixed, but originally randomly created hash key here. */
4f758c23 2728 siphash24(result, v, sz, hash_key.bytes);
01dde061
TG		 2729
2730 assert_cc(ETH_ALEN <= sizeof(result));
2731 memcpy(mac->ether_addr_octet, result, ETH_ALEN);
2732
2733 /* see eth_random_addr in the kernel */
2734 mac->ether_addr_octet[0] &= 0xfe; /* clear multicast bit */
2735 mac->ether_addr_octet[0] |= 0x02; /* set local assignment bit (IEEE802) */
2736
2737 return 0;
2738}
2739
5aa4bb6b 2740static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ], int *ifi) {
1c4baffc
TG		 2741 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
2742 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
4f758c23 2743 struct ether_addr mac_host, mac_container;
5aa4bb6b 2744 int r, i;
69c79d3c
LP		 2745
2746 if (!arg_private_network)
2747 return 0;
2748
2749 if (!arg_network_veth)
2750 return 0;
2751
08af0da2
LP		 2752 /* Use two different interface name prefixes depending whether
2753 * we are in bridge mode or not. */
c00524c9 2754 snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
4212a337 2755 arg_network_bridge ? "vb" : "ve", arg_machine);
69c79d3c 2756
e867ceb6
LP		 2757 r = generate_mac(&mac_container, CONTAINER_HASH_KEY, 0);
2758 if (r < 0)
2759 return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
4f758c23 2760
e867ceb6
LP		 2761 r = generate_mac(&mac_host, HOST_HASH_KEY, 0);
2762 if (r < 0)
2763 return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
01dde061 2764
1c4baffc 2765 r = sd_netlink_open(&rtnl);
f647962d
MS		 2766 if (r < 0)
2767 return log_error_errno(r, "Failed to connect to netlink: %m");
69c79d3c 2768
151b9b96 2769 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
f647962d
MS		 2770 if (r < 0)
2771 return log_error_errno(r, "Failed to allocate netlink message: %m");
69c79d3c 2772
1c4baffc 2773 r = sd_netlink_message_append_string(m, IFLA_IFNAME, iface_name);
f647962d
MS		 2774 if (r < 0)
2775 return log_error_errno(r, "Failed to add netlink interface name: %m");
69c79d3c 2776
1c4baffc 2777 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac_host);
f647962d
MS		 2778 if (r < 0)
2779 return log_error_errno(r, "Failed to add netlink MAC address: %m");
4f758c23 2780
1c4baffc 2781 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
f647962d
MS		 2782 if (r < 0)
2783 return log_error_errno(r, "Failed to open netlink container: %m");
69c79d3c 2784
1c4baffc 2785 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "veth");
f647962d
MS		 2786 if (r < 0)
2787 return log_error_errno(r, "Failed to open netlink container: %m");
69c79d3c 2788
1c4baffc 2789 r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
f647962d
MS		 2790 if (r < 0)
2791 return log_error_errno(r, "Failed to open netlink container: %m");
69c79d3c 2792
1c4baffc 2793 r = sd_netlink_message_append_string(m, IFLA_IFNAME, "host0");
f647962d
MS		 2794 if (r < 0)
2795 return log_error_errno(r, "Failed to add netlink interface name: %m");
01dde061 2796
1c4baffc 2797 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac_container);
f647962d
MS		 2798 if (r < 0)
2799 return log_error_errno(r, "Failed to add netlink MAC address: %m");
69c79d3c 2800
1c4baffc 2801 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
f647962d
MS		 2802 if (r < 0)
2803 return log_error_errno(r, "Failed to add netlink namespace field: %m");
69c79d3c 2804
1c4baffc 2805 r = sd_netlink_message_close_container(m);
f647962d
MS		 2806 if (r < 0)
2807 return log_error_errno(r, "Failed to close netlink container: %m");
69c79d3c 2808
1c4baffc 2809 r = sd_netlink_message_close_container(m);
f647962d
MS		 2810 if (r < 0)
2811 return log_error_errno(r, "Failed to close netlink container: %m");
69c79d3c 2812
1c4baffc 2813 r = sd_netlink_message_close_container(m);
f647962d
MS		 2814 if (r < 0)
2815 return log_error_errno(r, "Failed to close netlink container: %m");
69c79d3c 2816
1c4baffc 2817 r = sd_netlink_call(rtnl, m, 0, NULL);
f647962d 2818 if (r < 0)
637aa8a3 2819 return log_error_errno(r, "Failed to add new veth interfaces (host0, %s): %m", iface_name);
69c79d3c 2820
5aa4bb6b 2821 i = (int) if_nametoindex(iface_name);
4a62c710
MS		 2822 if (i <= 0)
2823 return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);
5aa4bb6b
LP		 2824
2825 *ifi = i;
2826
69c79d3c
LP		 2827 return 0;
2828}
2829
5aa4bb6b 2830static int setup_bridge(const char veth_name[], int *ifi) {
1c4baffc
TG		 2831 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
2832 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
ab046dde
TG		 2833 int r, bridge;
2834
2835 if (!arg_private_network)
2836 return 0;
2837
2838 if (!arg_network_veth)
2839 return 0;
2840
2841 if (!arg_network_bridge)
2842 return 0;
2843
2844 bridge = (int) if_nametoindex(arg_network_bridge);
4a62c710
MS		 2845 if (bridge <= 0)
2846 return log_error_errno(errno, "Failed to resolve interface %s: %m", arg_network_bridge);
ab046dde 2847
5aa4bb6b
LP		 2848 *ifi = bridge;
2849
1c4baffc 2850 r = sd_netlink_open(&rtnl);
f647962d
MS		 2851 if (r < 0)
2852 return log_error_errno(r, "Failed to connect to netlink: %m");
ab046dde 2853
151b9b96 2854 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
f647962d
MS		 2855 if (r < 0)
2856 return log_error_errno(r, "Failed to allocate netlink message: %m");
ab046dde 2857
039dd4af 2858 r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
f647962d
MS		 2859 if (r < 0)
2860 return log_error_errno(r, "Failed to set IFF_UP flag: %m");
039dd4af 2861
1c4baffc 2862 r = sd_netlink_message_append_string(m, IFLA_IFNAME, veth_name);
f647962d
MS		 2863 if (r < 0)
2864 return log_error_errno(r, "Failed to add netlink interface name field: %m");
ab046dde 2865
1c4baffc 2866 r = sd_netlink_message_append_u32(m, IFLA_MASTER, bridge);
f647962d
MS		 2867 if (r < 0)
2868 return log_error_errno(r, "Failed to add netlink master field: %m");
ab046dde 2869
1c4baffc 2870 r = sd_netlink_call(rtnl, m, 0, NULL);
f647962d
MS		 2871 if (r < 0)
2872 return log_error_errno(r, "Failed to add veth interface to bridge: %m");
ab046dde
TG		 2873
2874 return 0;
2875}
2876
c74e630d
LP		 2877static int parse_interface(struct udev *udev, const char *name) {
2878 _cleanup_udev_device_unref_ struct udev_device *d = NULL;
2879 char ifi_str[2 + DECIMAL_STR_MAX(int)];
2880 int ifi;
2881
2882 ifi = (int) if_nametoindex(name);
4a62c710
MS		 2883 if (ifi <= 0)
2884 return log_error_errno(errno, "Failed to resolve interface %s: %m", name);
c74e630d
LP		 2885
2886 sprintf(ifi_str, "n%i", ifi);
2887 d = udev_device_new_from_device_id(udev, ifi_str);
4a62c710
MS		 2888 if (!d)
2889 return log_error_errno(errno, "Failed to get udev device for interface %s: %m", name);
c74e630d
LP		 2890
2891 if (udev_device_get_is_initialized(d) <= 0) {
2892 log_error("Network interface %s is not initialized yet.", name);
2893 return -EBUSY;
2894 }
2895
2896 return ifi;
2897}
2898
69c79d3c 2899static int move_network_interfaces(pid_t pid) {
7e227024 2900 _cleanup_udev_unref_ struct udev *udev = NULL;
1c4baffc 2901 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
aa28aefe
LP		 2902 char **i;
2903 int r;
2904
2905 if (!arg_private_network)
2906 return 0;
2907
2908 if (strv_isempty(arg_network_interfaces))
2909 return 0;
2910
1c4baffc 2911 r = sd_netlink_open(&rtnl);
f647962d
MS		 2912 if (r < 0)
2913 return log_error_errno(r, "Failed to connect to netlink: %m");
aa28aefe 2914
7e227024
LP		 2915 udev = udev_new();
2916 if (!udev) {
2917 log_error("Failed to connect to udev.");
2918 return -ENOMEM;
2919 }
2920
aa28aefe 2921 STRV_FOREACH(i, arg_network_interfaces) {
1c4baffc 2922 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
b88eb17a 2923 int ifi;
aa28aefe 2924
c74e630d
LP		 2925 ifi = parse_interface(udev, *i);
2926 if (ifi < 0)
2927 return ifi;
2928
3125b3ef 2929 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
f647962d
MS		 2930 if (r < 0)
2931 return log_error_errno(r, "Failed to allocate netlink message: %m");
aa28aefe 2932
1c4baffc 2933 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
f647962d
MS		 2934 if (r < 0)
2935 return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
7e227024 2936
1c4baffc 2937 r = sd_netlink_call(rtnl, m, 0, NULL);
f647962d
MS		 2938 if (r < 0)
2939 return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
c74e630d 2940 }
7e227024 2941
c74e630d
LP		 2942 return 0;
2943}
2944
2945static int setup_macvlan(pid_t pid) {
2946 _cleanup_udev_unref_ struct udev *udev = NULL;
1c4baffc 2947 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
e867ceb6 2948 unsigned idx = 0;
c74e630d
LP		 2949 char **i;
2950 int r;
2951
2952 if (!arg_private_network)
2953 return 0;
2954
2955 if (strv_isempty(arg_network_macvlan))
2956 return 0;
2957
1c4baffc 2958 r = sd_netlink_open(&rtnl);
f647962d
MS		 2959 if (r < 0)
2960 return log_error_errno(r, "Failed to connect to netlink: %m");
c74e630d
LP		 2961
2962 udev = udev_new();
2963 if (!udev) {
2964 log_error("Failed to connect to udev.");
2965 return -ENOMEM;
2966 }
2967
2968 STRV_FOREACH(i, arg_network_macvlan) {
1c4baffc 2969 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
c74e630d 2970 _cleanup_free_ char *n = NULL;
e867ceb6 2971 struct ether_addr mac;
c74e630d
LP		 2972 int ifi;
2973
2974 ifi = parse_interface(udev, *i);
2975 if (ifi < 0)
2976 return ifi;
2977
e867ceb6
LP		 2978 r = generate_mac(&mac, MACVLAN_HASH_KEY, idx++);
2979 if (r < 0)
2980 return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
2981
c74e630d 2982 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
f647962d
MS		 2983 if (r < 0)
2984 return log_error_errno(r, "Failed to allocate netlink message: %m");
aa28aefe 2985
1c4baffc 2986 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
f647962d
MS		 2987 if (r < 0)
2988 return log_error_errno(r, "Failed to add netlink interface index: %m");
c74e630d
LP		 2989
2990 n = strappend("mv-", *i);
2991 if (!n)
2992 return log_oom();
2993
2994 strshorten(n, IFNAMSIZ-1);
2995
1c4baffc 2996 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
f647962d
MS		 2997 if (r < 0)
2998 return log_error_errno(r, "Failed to add netlink interface name: %m");
c74e630d 2999
1c4baffc 3000 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
e867ceb6
LP		 3001 if (r < 0)
3002 return log_error_errno(r, "Failed to add netlink MAC address: %m");
3003
1c4baffc 3004 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
f647962d
MS		 3005 if (r < 0)
3006 return log_error_errno(r, "Failed to add netlink namespace field: %m");
c74e630d 3007
1c4baffc 3008 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
f647962d
MS		 3009 if (r < 0)
3010 return log_error_errno(r, "Failed to open netlink container: %m");
c74e630d 3011
1c4baffc 3012 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
f647962d
MS		 3013 if (r < 0)
3014 return log_error_errno(r, "Failed to open netlink container: %m");
c74e630d 3015
1c4baffc 3016 r = sd_netlink_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
f647962d
MS		 3017 if (r < 0)
3018 return log_error_errno(r, "Failed to append macvlan mode: %m");
c74e630d 3019
1c4baffc 3020 r = sd_netlink_message_close_container(m);
f647962d
MS		 3021 if (r < 0)
3022 return log_error_errno(r, "Failed to close netlink container: %m");
c74e630d 3023
1c4baffc 3024 r = sd_netlink_message_close_container(m);
f647962d
MS		 3025 if (r < 0)
3026 return log_error_errno(r, "Failed to close netlink container: %m");
aa28aefe 3027
1c4baffc 3028 r = sd_netlink_call(rtnl, m, 0, NULL);
f647962d
MS		 3029 if (r < 0)
3030 return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
aa28aefe
LP		 3031 }
3032
3033 return 0;
3034}
3035
4bbfe7ad
TG		 3036static int setup_ipvlan(pid_t pid) {
3037 _cleanup_udev_unref_ struct udev *udev = NULL;
1c4baffc 3038 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
4bbfe7ad
TG		 3039 char **i;
3040 int r;
3041
3042 if (!arg_private_network)
3043 return 0;
3044
3045 if (strv_isempty(arg_network_ipvlan))
3046 return 0;
3047
1c4baffc 3048 r = sd_netlink_open(&rtnl);
4bbfe7ad
TG		 3049 if (r < 0)
3050 return log_error_errno(r, "Failed to connect to netlink: %m");
3051
3052 udev = udev_new();
3053 if (!udev) {
3054 log_error("Failed to connect to udev.");
3055 return -ENOMEM;
3056 }
3057
3058 STRV_FOREACH(i, arg_network_ipvlan) {
1c4baffc 3059 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
4bbfe7ad
TG		 3060 _cleanup_free_ char *n = NULL;
3061 int ifi;
3062
3063 ifi = parse_interface(udev, *i);
3064 if (ifi < 0)
3065 return ifi;
3066
3067 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
3068 if (r < 0)
3069 return log_error_errno(r, "Failed to allocate netlink message: %m");
3070
1c4baffc 3071 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
4bbfe7ad
TG		 3072 if (r < 0)
3073 return log_error_errno(r, "Failed to add netlink interface index: %m");
3074
3075 n = strappend("iv-", *i);
3076 if (!n)
3077 return log_oom();
3078
3079 strshorten(n, IFNAMSIZ-1);
3080
1c4baffc 3081 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
4bbfe7ad
TG		 3082 if (r < 0)
3083 return log_error_errno(r, "Failed to add netlink interface name: %m");
3084
1c4baffc 3085 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
4bbfe7ad
TG		 3086 if (r < 0)
3087 return log_error_errno(r, "Failed to add netlink namespace field: %m");
3088
1c4baffc 3089 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
4bbfe7ad
TG		 3090 if (r < 0)
3091 return log_error_errno(r, "Failed to open netlink container: %m");
3092
1c4baffc 3093 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
4bbfe7ad
TG		 3094 if (r < 0)
3095 return log_error_errno(r, "Failed to open netlink container: %m");
3096
1c4baffc 3097 r = sd_netlink_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
4bbfe7ad
TG		 3098 if (r < 0)
3099 return log_error_errno(r, "Failed to add ipvlan mode: %m");
3100
1c4baffc 3101 r = sd_netlink_message_close_container(m);
4bbfe7ad
TG		 3102 if (r < 0)
3103 return log_error_errno(r, "Failed to close netlink container: %m");
3104
1c4baffc 3105 r = sd_netlink_message_close_container(m);
4bbfe7ad
TG		 3106 if (r < 0)
3107 return log_error_errno(r, "Failed to close netlink container: %m");
3108
1c4baffc 3109 r = sd_netlink_call(rtnl, m, 0, NULL);
4bbfe7ad
TG		 3110 if (r < 0)
3111 return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
3112 }
3113
3114 return 0;
3115}
3116
28650077 3117static int setup_seccomp(void) {
24fb1112
LP		 3118
3119#ifdef HAVE_SECCOMP
9a71b112
JF		 3120 static const struct {
3121 uint64_t capability;
3122 int syscall_num;
3123 } blacklist[] = {
5ba7a268
LP		 3124 { CAP_SYS_RAWIO, SCMP_SYS(iopl) },
3125 { CAP_SYS_RAWIO, SCMP_SYS(ioperm) },
3126 { CAP_SYS_BOOT, SCMP_SYS(kexec_load) },
3127 { CAP_SYS_ADMIN, SCMP_SYS(swapon) },
3128 { CAP_SYS_ADMIN, SCMP_SYS(swapoff) },
3129 { CAP_SYS_ADMIN, SCMP_SYS(open_by_handle_at) },
3130 { CAP_SYS_MODULE, SCMP_SYS(init_module) },
3131 { CAP_SYS_MODULE, SCMP_SYS(finit_module) },
3132 { CAP_SYS_MODULE, SCMP_SYS(delete_module) },
3133 { CAP_SYSLOG, SCMP_SYS(syslog) },
d0a0ccf3
JF		 3134 };
3135
24fb1112 3136 scmp_filter_ctx seccomp;
28650077 3137 unsigned i;
24fb1112
LP		 3138 int r;
3139
24fb1112
LP		 3140 seccomp = seccomp_init(SCMP_ACT_ALLOW);
3141 if (!seccomp)
3142 return log_oom();
3143
e9642be2 3144 r = seccomp_add_secondary_archs(seccomp);
9875fd78 3145 if (r < 0) {
da927ba9 3146 log_error_errno(r, "Failed to add secondary archs to seccomp filter: %m");
e9642be2
LP		 3147 goto finish;
3148 }
3149
28650077 3150 for (i = 0; i < ELEMENTSOF(blacklist); i++) {
9a71b112
JF		 3151 if (arg_retain & (1ULL << blacklist[i].capability))
3152 continue;
3153
3154 r = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EPERM), blacklist[i].syscall_num, 0);
28650077
LP		 3155 if (r == -EFAULT)
3156 continue; /* unknown syscall */
3157 if (r < 0) {
da927ba9 3158 log_error_errno(r, "Failed to block syscall: %m");
28650077
LP		 3159 goto finish;
3160 }
3161 }
3162
d0a0ccf3 3163
28650077
LP		 3164 /*
3165 Audit is broken in containers, much of the userspace audit
3166 hookup will fail if running inside a container. We don't
3167 care and just turn off creation of audit sockets.
3168
3169 This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
3170 with EAFNOSUPPORT which audit userspace uses as indication
3171 that audit is disabled in the kernel.
3172 */
3173
3302da46 3174 r = seccomp_rule_add(
24fb1112
LP		 3175 seccomp,
3176 SCMP_ACT_ERRNO(EAFNOSUPPORT),
3177 SCMP_SYS(socket),
3178 2,
3179 SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
3180 SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
3181 if (r < 0) {
da927ba9 3182 log_error_errno(r, "Failed to add audit seccomp rule: %m");
24fb1112
LP		 3183 goto finish;
3184 }
3185
3186 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
3187 if (r < 0) {
da927ba9 3188 log_error_errno(r, "Failed to unset NO_NEW_PRIVS: %m");
24fb1112
LP		 3189 goto finish;
3190 }
3191
3192 r = seccomp_load(seccomp);
9b1cbdc6
ILG		 3193 if (r == -EINVAL) {
3194 log_debug_errno(r, "Kernel is probably not configured with CONFIG_SECCOMP. Disabling seccomp audit filter: %m");
3195 r = 0;
3196 goto finish;
3197 }
3198 if (r < 0) {
da927ba9 3199 log_error_errno(r, "Failed to install seccomp audit filter: %m");
9b1cbdc6
ILG		 3200 goto finish;
3201 }
24fb1112
LP		 3202
3203finish:
3204 seccomp_release(seccomp);
3205 return r;
3206#else
3207 return 0;
3208#endif
3209
3210}
3211
785890ac
LP		 3212static int setup_propagate(const char *root) {
3213 const char *p, *q;
3214
3215 (void) mkdir_p("/run/systemd/nspawn/", 0755);
3216 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 3217 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 3218 (void) mkdir_p(p, 0600);
3219
03cfe0d5
LP		 3220 if (userns_mkdir(root, "/run/systemd", 0755, 0, 0) < 0)
3221 return log_error_errno(errno, "Failed to create /run/systemd: %m");
3222
3223 if (userns_mkdir(root, "/run/systemd/nspawn", 0755, 0, 0) < 0)
3224 return log_error_errno(errno, "Failed to create /run/systemd/nspawn: %m");
3225
3226 if (userns_mkdir(root, "/run/systemd/nspawn/incoming", 0600, 0, 0) < 0)
3227 return log_error_errno(errno, "Failed to create /run/systemd/nspawn/incoming: %m");
785890ac 3228
03cfe0d5 3229 q = prefix_roota(root, "/run/systemd/nspawn/incoming");
785890ac
LP		 3230 if (mount(p, q, NULL, MS_BIND, NULL) < 0)
3231 return log_error_errno(errno, "Failed to install propagation bind mount.");
3232
3233 if (mount(NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0)
3234 return log_error_errno(errno, "Failed to make propagation mount read-only");
3235
3236 return 0;
3237}
3238
1b9e5b12
LP		 3239static int setup_image(char **device_path, int *loop_nr) {
3240 struct loop_info64 info = {
3241 .lo_flags = LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN
3242 };
3243 _cleanup_close_ int fd = -1, control = -1, loop = -1;
3244 _cleanup_free_ char* loopdev = NULL;
3245 struct stat st;
3246 int r, nr;
3247
3248 assert(device_path);
3249 assert(loop_nr);
ec16945e 3250 assert(arg_image);
1b9e5b12
LP		 3251
3252 fd = open(arg_image, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
4a62c710
MS		 3253 if (fd < 0)
3254 return log_error_errno(errno, "Failed to open %s: %m", arg_image);
1b9e5b12 3255
4a62c710
MS		 3256 if (fstat(fd, &st) < 0)
3257 return log_error_errno(errno, "Failed to stat %s: %m", arg_image);
1b9e5b12
LP		 3258
3259 if (S_ISBLK(st.st_mode)) {
3260 char *p;
3261
3262 p = strdup(arg_image);
3263 if (!p)
3264 return log_oom();
3265
3266 *device_path = p;
3267
3268 *loop_nr = -1;
3269
3270 r = fd;
3271 fd = -1;
3272
3273 return r;
3274 }
3275
3276 if (!S_ISREG(st.st_mode)) {
56f64d95 3277 log_error_errno(errno, "%s is not a regular file or block device: %m", arg_image);
1b9e5b12
LP		 3278 return -EINVAL;
3279 }
3280
3281 control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
4a62c710
MS		 3282 if (control < 0)
3283 return log_error_errno(errno, "Failed to open /dev/loop-control: %m");
1b9e5b12
LP		 3284
3285 nr = ioctl(control, LOOP_CTL_GET_FREE);
4a62c710
MS		 3286 if (nr < 0)
3287 return log_error_errno(errno, "Failed to allocate loop device: %m");
1b9e5b12
LP		 3288
3289 if (asprintf(&loopdev, "/dev/loop%i", nr) < 0)
3290 return log_oom();
3291
3292 loop = open(loopdev, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
4a62c710
MS		 3293 if (loop < 0)
3294 return log_error_errno(errno, "Failed to open loop device %s: %m", loopdev);
1b9e5b12 3295
4a62c710
MS		 3296 if (ioctl(loop, LOOP_SET_FD, fd) < 0)
3297 return log_error_errno(errno, "Failed to set loopback file descriptor on %s: %m", loopdev);
1b9e5b12
LP		 3298
3299 if (arg_read_only)
3300 info.lo_flags |= LO_FLAGS_READ_ONLY;
3301
4a62c710
MS		 3302 if (ioctl(loop, LOOP_SET_STATUS64, &info) < 0)
3303 return log_error_errno(errno, "Failed to set loopback settings on %s: %m", loopdev);
1b9e5b12
LP		 3304
3305 *device_path = loopdev;
3306 loopdev = NULL;
3307
3308 *loop_nr = nr;
3309
3310 r = loop;
3311 loop = -1;
3312
3313 return r;
3314}
3315
ada4799a
LP		 3316#define PARTITION_TABLE_BLURB \
3317 "Note that the disk image needs to either contain only a single MBR partition of\n" \
4aab5d0c 3318 "type 0x83 that is marked bootable, or a single GPT partition of type " \
f6c51a81 3319 "0FC63DAF-8483-4772-8E79-3D69D8477DE4 or follow\n" \
ada4799a
LP		 3320 " http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/\n" \
3321 "to be bootable with systemd-nspawn."
3322
1b9e5b12
LP		 3323static int dissect_image(
3324 int fd,
727fd4fd
LP		 3325 char **root_device, bool *root_device_rw,
3326 char **home_device, bool *home_device_rw,
3327 char **srv_device, bool *srv_device_rw,
1b9e5b12
LP		 3328 bool *secondary) {
3329
3330#ifdef HAVE_BLKID
01dc33ce
ZJS		 3331 int home_nr = -1, srv_nr = -1;
3332#ifdef GPT_ROOT_NATIVE
3333 int root_nr = -1;
3334#endif
3335#ifdef GPT_ROOT_SECONDARY
3336 int secondary_root_nr = -1;
3337#endif
f6c51a81 3338 _cleanup_free_ char *home = NULL, *root = NULL, *secondary_root = NULL, *srv = NULL, *generic = NULL;
1b9e5b12
LP		 3339 _cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
3340 _cleanup_udev_device_unref_ struct udev_device *d = NULL;
3341 _cleanup_blkid_free_probe_ blkid_probe b = NULL;
3342 _cleanup_udev_unref_ struct udev *udev = NULL;
3343 struct udev_list_entry *first, *item;
f6c51a81 3344 bool home_rw = true, root_rw = true, secondary_root_rw = true, srv_rw = true, generic_rw = true;
c09ef2e4 3345 bool is_gpt, is_mbr, multiple_generic = false;
1b9e5b12
LP		 3346 const char *pttype = NULL;
3347 blkid_partlist pl;
3348 struct stat st;
c09ef2e4 3349 unsigned i;
1b9e5b12
LP		 3350 int r;
3351
3352 assert(fd >= 0);
3353 assert(root_device);
3354 assert(home_device);
3355 assert(srv_device);
3356 assert(secondary);
ec16945e 3357 assert(arg_image);
1b9e5b12
LP		 3358
3359 b = blkid_new_probe();
3360 if (!b)
3361 return log_oom();
3362
3363 errno = 0;
3364 r = blkid_probe_set_device(b, fd, 0, 0);
3365 if (r != 0) {
3366 if (errno == 0)
3367 return log_oom();
3368
56f64d95 3369 log_error_errno(errno, "Failed to set device on blkid probe: %m");
1b9e5b12
LP		 3370 return -errno;
3371 }
3372
3373 blkid_probe_enable_partitions(b, 1);
3374 blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
3375
3376 errno = 0;
3377 r = blkid_do_safeprobe(b);
3378 if (r == -2 || r == 1) {
ada4799a
LP		 3379 log_error("Failed to identify any partition table on\n"
3380 " %s\n"
3381 PARTITION_TABLE_BLURB, arg_image);
1b9e5b12
LP		 3382 return -EINVAL;
3383 } else if (r != 0) {
3384 if (errno == 0)
3385 errno = EIO;
56f64d95 3386 log_error_errno(errno, "Failed to probe: %m");
1b9e5b12
LP		 3387 return -errno;
3388 }
3389
48861960 3390 (void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
ada4799a
LP		 3391
3392 is_gpt = streq_ptr(pttype, "gpt");
3393 is_mbr = streq_ptr(pttype, "dos");
3394
3395 if (!is_gpt && !is_mbr) {
3396 log_error("No GPT or MBR partition table discovered on\n"
3397 " %s\n"
3398 PARTITION_TABLE_BLURB, arg_image);
1b9e5b12
LP		 3399 return -EINVAL;
3400 }
3401
3402 errno = 0;
3403 pl = blkid_probe_get_partitions(b);
3404 if (!pl) {
3405 if (errno == 0)
3406 return log_oom();
3407
3408 log_error("Failed to list partitions of %s", arg_image);
3409 return -errno;
3410 }
3411
3412 udev = udev_new();
3413 if (!udev)
3414 return log_oom();
3415
4a62c710
MS		 3416 if (fstat(fd, &st) < 0)
3417 return log_error_errno(errno, "Failed to stat block device: %m");
1b9e5b12 3418
c09ef2e4
LP		 3419 d = udev_device_new_from_devnum(udev, 'b', st.st_rdev);
3420 if (!d)
1b9e5b12
LP		 3421 return log_oom();
3422
c09ef2e4
LP		 3423 for (i = 0;; i++) {
3424 int n, m;
1b9e5b12 3425
c09ef2e4
LP		 3426 if (i >= 10) {
3427 log_error("Kernel partitions never appeared.");
3428 return -ENXIO;
3429 }
3430
3431 e = udev_enumerate_new(udev);
3432 if (!e)
3433 return log_oom();
3434
3435 r = udev_enumerate_add_match_parent(e, d);
3436 if (r < 0)
3437 return log_oom();
3438
3439 r = udev_enumerate_scan_devices(e);
3440 if (r < 0)
3441 return log_error_errno(r, "Failed to scan for partition devices of %s: %m", arg_image);
3442
3443 /* Count the partitions enumerated by the kernel */
3444 n = 0;
3445 first = udev_enumerate_get_list_entry(e);
3446 udev_list_entry_foreach(item, first)
3447 n++;
3448
3449 /* Count the partitions enumerated by blkid */
3450 m = blkid_partlist_numof_partitions(pl);
3451 if (n == m + 1)
3452 break;
3453 if (n > m + 1) {
3454 log_error("blkid and kernel partition list do not match.");
3455 return -EIO;
3456 }
3457 if (n < m + 1) {
3458 unsigned j;
3459
3460 /* The kernel has probed fewer partitions than
3461 * blkid? Maybe the kernel prober is still
3462 * running or it got EBUSY because udev
3463 * already opened the device. Let's reprobe
3464 * the device, which is a synchronous call
3465 * that waits until probing is complete. */
3466
3467 for (j = 0; j < 20; j++) {
3468
3469 r = ioctl(fd, BLKRRPART, 0);
3470 if (r < 0)
3471 r = -errno;
3472 if (r >= 0 || r != -EBUSY)
3473 break;
3474
3475 /* If something else has the device
3476 * open, such as an udev rule, the
3477 * ioctl will return EBUSY. Since
3478 * there's no way to wait until it
3479 * isn't busy anymore, let's just wait
3480 * a bit, and try again.
3481 *
3482 * This is really something they
3483 * should fix in the kernel! */
3484
3485 usleep(50 * USEC_PER_MSEC);
3486 }
3487
3488 if (r < 0)
3489 return log_error_errno(r, "Failed to reread partition table: %m");
3490 }
3491
3492 e = udev_enumerate_unref(e);
3493 }
1b9e5b12
LP		 3494
3495 first = udev_enumerate_get_list_entry(e);
3496 udev_list_entry_foreach(item, first) {
3497 _cleanup_udev_device_unref_ struct udev_device *q;
ada4799a 3498 const char *node;
727fd4fd 3499 unsigned long long flags;
1b9e5b12
LP		 3500 blkid_partition pp;
3501 dev_t qn;
3502 int nr;
3503
3504 errno = 0;
3505 q = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
3506 if (!q) {
3507 if (!errno)
3508 errno = ENOMEM;
3509
56f64d95 3510 log_error_errno(errno, "Failed to get partition device of %s: %m", arg_image);
1b9e5b12
LP		 3511 return -errno;
3512 }
3513
3514 qn = udev_device_get_devnum(q);
3515 if (major(qn) == 0)
3516 continue;
3517
3518 if (st.st_rdev == qn)
3519 continue;
3520
3521 node = udev_device_get_devnode(q);
3522 if (!node)
3523 continue;
3524
3525 pp = blkid_partlist_devno_to_partition(pl, qn);
3526 if (!pp)
3527 continue;
3528
727fd4fd 3529 flags = blkid_partition_get_flags(pp);
727fd4fd 3530
1b9e5b12
LP		 3531 nr = blkid_partition_get_partno(pp);
3532 if (nr < 0)
3533 continue;
3534
ada4799a
LP		 3535 if (is_gpt) {
3536 sd_id128_t type_id;
3537 const char *stype;
1b9e5b12 3538
f6c51a81
LP		 3539 if (flags & GPT_FLAG_NO_AUTO)
3540 continue;
3541
ada4799a
LP		 3542 stype = blkid_partition_get_type_string(pp);
3543 if (!stype)
3544 continue;
1b9e5b12 3545
ada4799a 3546 if (sd_id128_from_string(stype, &type_id) < 0)
1b9e5b12
LP		 3547 continue;
3548
ada4799a 3549 if (sd_id128_equal(type_id, GPT_HOME)) {
727fd4fd 3550
ada4799a
LP		 3551 if (home && nr >= home_nr)
3552 continue;
1b9e5b12 3553
ada4799a
LP		 3554 home_nr = nr;
3555 home_rw = !(flags & GPT_FLAG_READ_ONLY);
1b9e5b12 3556
ada4799a
LP		 3557 r = free_and_strdup(&home, node);
3558 if (r < 0)
3559 return log_oom();
727fd4fd 3560
ada4799a
LP		 3561 } else if (sd_id128_equal(type_id, GPT_SRV)) {
3562
3563 if (srv && nr >= srv_nr)
3564 continue;
3565
3566 srv_nr = nr;
3567 srv_rw = !(flags & GPT_FLAG_READ_ONLY);
3568
3569 r = free_and_strdup(&srv, node);
3570 if (r < 0)
3571 return log_oom();
3572 }
1b9e5b12 3573#ifdef GPT_ROOT_NATIVE
ada4799a 3574 else if (sd_id128_equal(type_id, GPT_ROOT_NATIVE)) {
1b9e5b12 3575
ada4799a
LP		 3576 if (root && nr >= root_nr)
3577 continue;
1b9e5b12 3578
ada4799a
LP		 3579 root_nr = nr;
3580 root_rw = !(flags & GPT_FLAG_READ_ONLY);
727fd4fd 3581
ada4799a
LP		 3582 r = free_and_strdup(&root, node);
3583 if (r < 0)
3584 return log_oom();
3585 }
1b9e5b12
LP		 3586#endif
3587#ifdef GPT_ROOT_SECONDARY
ada4799a
LP		 3588 else if (sd_id128_equal(type_id, GPT_ROOT_SECONDARY)) {
3589
3590 if (secondary_root && nr >= secondary_root_nr)
3591 continue;
3592
3593 secondary_root_nr = nr;
3594 secondary_root_rw = !(flags & GPT_FLAG_READ_ONLY);
3595
3596 r = free_and_strdup(&secondary_root, node);
3597 if (r < 0)
3598 return log_oom();
3599 }
3600#endif
f6c51a81
LP		 3601 else if (sd_id128_equal(type_id, GPT_LINUX_GENERIC)) {
3602
3603 if (generic)
3604 multiple_generic = true;
3605 else {
3606 generic_rw = !(flags & GPT_FLAG_READ_ONLY);
3607
3608 r = free_and_strdup(&generic, node);
3609 if (r < 0)
3610 return log_oom();
3611 }
3612 }
ada4799a
LP		 3613
3614 } else if (is_mbr) {
3615 int type;
1b9e5b12 3616
f6c51a81
LP		 3617 if (flags != 0x80) /* Bootable flag */
3618 continue;
3619
ada4799a
LP		 3620 type = blkid_partition_get_type(pp);
3621 if (type != 0x83) /* Linux partition */
1b9e5b12
LP		 3622 continue;
3623
f6c51a81
LP		 3624 if (generic)
3625 multiple_generic = true;
3626 else {
3627 generic_rw = true;
727fd4fd 3628
f6c51a81
LP		 3629 r = free_and_strdup(&root, node);
3630 if (r < 0)
3631 return log_oom();
3632 }
1b9e5b12 3633 }
1b9e5b12
LP		 3634 }
3635
1b9e5b12
LP		 3636 if (root) {
3637 *root_device = root;
3638 root = NULL;
727fd4fd
LP		 3639
3640 *root_device_rw = root_rw;
1b9e5b12
LP		 3641 *secondary = false;
3642 } else if (secondary_root) {
3643 *root_device = secondary_root;
3644 secondary_root = NULL;
727fd4fd
LP		 3645
3646 *root_device_rw = secondary_root_rw;
1b9e5b12 3647 *secondary = true;
f6c51a81
LP		 3648 } else if (generic) {
3649
3650 /* There were no partitions with precise meanings
3651 * around, but we found generic partitions. In this
3652 * case, if there's only one, we can go ahead and boot
3653 * it, otherwise we bail out, because we really cannot
3654 * make any sense of it. */
3655
3656 if (multiple_generic) {
3657 log_error("Identified multiple bootable Linux partitions on\n"
3658 " %s\n"
3659 PARTITION_TABLE_BLURB, arg_image);
3660 return -EINVAL;
3661 }
3662
3663 *root_device = generic;
3664 generic = NULL;
3665
3666 *root_device_rw = generic_rw;
3667 *secondary = false;
3668 } else {
3669 log_error("Failed to identify root partition in disk image\n"
3670 " %s\n"
3671 PARTITION_TABLE_BLURB, arg_image);
3672 return -EINVAL;
1b9e5b12
LP		 3673 }
3674
3675 if (home) {
3676 *home_device = home;
3677 home = NULL;
727fd4fd
LP		 3678
3679 *home_device_rw = home_rw;
1b9e5b12
LP		 3680 }
3681
3682 if (srv) {
3683 *srv_device = srv;
3684 srv = NULL;
727fd4fd
LP		 3685
3686 *srv_device_rw = srv_rw;
1b9e5b12
LP		 3687 }
3688
3689 return 0;
3690#else
3691 log_error("--image= is not supported, compiled without blkid support.");
15411c0c 3692 return -EOPNOTSUPP;
1b9e5b12
LP		 3693#endif
3694}
3695
727fd4fd 3696static int mount_device(const char *what, const char *where, const char *directory, bool rw) {
1b9e5b12
LP		 3697#ifdef HAVE_BLKID
3698 _cleanup_blkid_free_probe_ blkid_probe b = NULL;
3699 const char *fstype, *p;
3700 int r;
3701
3702 assert(what);
3703 assert(where);
3704
727fd4fd
LP		 3705 if (arg_read_only)
3706 rw = false;
3707
1b9e5b12 3708 if (directory)
63c372cb 3709 p = strjoina(where, directory);
1b9e5b12
LP		 3710 else
3711 p = where;
3712
3713 errno = 0;
3714 b = blkid_new_probe_from_filename(what);
3715 if (!b) {
3716 if (errno == 0)
3717 return log_oom();
56f64d95 3718 log_error_errno(errno, "Failed to allocate prober for %s: %m", what);
1b9e5b12
LP		 3719 return -errno;
3720 }
3721
3722 blkid_probe_enable_superblocks(b, 1);
3723 blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
3724
3725 errno = 0;
3726 r = blkid_do_safeprobe(b);
3727 if (r == -1 || r == 1) {
3728 log_error("Cannot determine file system type of %s", what);
3729 return -EINVAL;
3730 } else if (r != 0) {
3731 if (errno == 0)
3732 errno = EIO;
56f64d95 3733 log_error_errno(errno, "Failed to probe %s: %m", what);
1b9e5b12
LP		 3734 return -errno;
3735 }
3736
3737 errno = 0;
3738 if (blkid_probe_lookup_value(b, "TYPE", &fstype, NULL) < 0) {
3739 if (errno == 0)
3740 errno = EINVAL;
3741 log_error("Failed to determine file system type of %s", what);
3742 return -errno;
3743 }
3744
3745 if (streq(fstype, "crypto_LUKS")) {
3746 log_error("nspawn currently does not support LUKS disk images.");
15411c0c 3747 return -EOPNOTSUPP;
1b9e5b12
LP		 3748 }
3749
4a62c710
MS		 3750 if (mount(what, p, fstype, MS_NODEV|(rw ? 0 : MS_RDONLY), NULL) < 0)
3751 return log_error_errno(errno, "Failed to mount %s: %m", what);
1b9e5b12
LP		 3752
3753 return 0;
3754#else
3755 log_error("--image= is not supported, compiled without blkid support.");
15411c0c 3756 return -EOPNOTSUPP;
1b9e5b12
LP		 3757#endif
3758}
3759
727fd4fd
LP		 3760static int mount_devices(
3761 const char *where,
3762 const char *root_device, bool root_device_rw,
3763 const char *home_device, bool home_device_rw,
3764 const char *srv_device, bool srv_device_rw) {
1b9e5b12
LP		 3765 int r;
3766
3767 assert(where);
3768
3769 if (root_device) {
727fd4fd 3770 r = mount_device(root_device, arg_directory, NULL, root_device_rw);
f647962d
MS		 3771 if (r < 0)
3772 return log_error_errno(r, "Failed to mount root directory: %m");
1b9e5b12
LP		 3773 }
3774
3775 if (home_device) {
727fd4fd 3776 r = mount_device(home_device, arg_directory, "/home", home_device_rw);
f647962d
MS		 3777 if (r < 0)
3778 return log_error_errno(r, "Failed to mount home directory: %m");
1b9e5b12
LP		 3779 }
3780
3781 if (srv_device) {
727fd4fd 3782 r = mount_device(srv_device, arg_directory, "/srv", srv_device_rw);
f647962d
MS		 3783 if (r < 0)
3784 return log_error_errno(r, "Failed to mount server data directory: %m");
1b9e5b12
LP		 3785 }
3786
3787 return 0;
3788}
3789
3790static void loop_remove(int nr, int *image_fd) {
3791 _cleanup_close_ int control = -1;
e8c8ddcc 3792 int r;
1b9e5b12
LP		 3793
3794 if (nr < 0)
3795 return;
3796
3797 if (image_fd && *image_fd >= 0) {
e8c8ddcc
TG		 3798 r = ioctl(*image_fd, LOOP_CLR_FD);
3799 if (r < 0)
5e4074aa 3800 log_debug_errno(errno, "Failed to close loop image: %m");
03e334a1 3801 *image_fd = safe_close(*image_fd);
1b9e5b12
LP		 3802 }
3803
3804 control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
e8c8ddcc 3805 if (control < 0) {
56f64d95 3806 log_warning_errno(errno, "Failed to open /dev/loop-control: %m");
1b9e5b12 3807 return;
e8c8ddcc 3808 }
1b9e5b12 3809
e8c8ddcc
TG		 3810 r = ioctl(control, LOOP_CTL_REMOVE, nr);
3811 if (r < 0)
5e4074aa 3812 log_debug_errno(errno, "Failed to remove loop %d: %m", nr);
1b9e5b12
LP		 3813}
3814
0cb9fbcd
LP		 3815static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
3816 int pipe_fds[2];
3817 pid_t pid;
3818
3819 assert(database);
3820 assert(key);
3821 assert(rpid);
3822
4a62c710
MS		 3823 if (pipe2(pipe_fds, O_CLOEXEC) < 0)
3824 return log_error_errno(errno, "Failed to allocate pipe: %m");
0cb9fbcd
LP		 3825
3826 pid = fork();
4a62c710
MS		 3827 if (pid < 0)
3828 return log_error_errno(errno, "Failed to fork getent child: %m");
3829 else if (pid == 0) {
0cb9fbcd
LP		 3830 int nullfd;
3831 char *empty_env = NULL;
3832
3833 if (dup3(pipe_fds[1], STDOUT_FILENO, 0) < 0)
3834 _exit(EXIT_FAILURE);
3835
3836 if (pipe_fds[0] > 2)
03e334a1 3837 safe_close(pipe_fds[0]);
0cb9fbcd 3838 if (pipe_fds[1] > 2)
03e334a1 3839 safe_close(pipe_fds[1]);
0cb9fbcd
LP		 3840
3841 nullfd = open("/dev/null", O_RDWR);
3842 if (nullfd < 0)
3843 _exit(EXIT_FAILURE);
3844
3845 if (dup3(nullfd, STDIN_FILENO, 0) < 0)
3846 _exit(EXIT_FAILURE);
3847
3848 if (dup3(nullfd, STDERR_FILENO, 0) < 0)
3849 _exit(EXIT_FAILURE);
3850
3851 if (nullfd > 2)
03e334a1 3852 safe_close(nullfd);
0cb9fbcd 3853
ce30c8dc
LP		 3854 (void) reset_all_signal_handlers();
3855 (void) reset_signal_mask();
0cb9fbcd
LP		 3856 close_all_fds(NULL, 0);
3857
4de82926
MM		 3858 execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
3859 execle("/bin/getent", "getent", database, key, NULL, &empty_env);
0cb9fbcd
LP		 3860 _exit(EXIT_FAILURE);
3861 }
3862
03e334a1 3863 pipe_fds[1] = safe_close(pipe_fds[1]);
0cb9fbcd
LP		 3864
3865 *rpid = pid;
3866
3867 return pipe_fds[0];
3868}
3869
3870static int change_uid_gid(char **_home) {
a2a5291b
ZJS		 3871 char line[LINE_MAX], *x, *u, *g, *h;
3872 const char *word, *state;
0cb9fbcd
LP		 3873 _cleanup_free_ uid_t *uids = NULL;
3874 _cleanup_free_ char *home = NULL;
3875 _cleanup_fclose_ FILE *f = NULL;
3876 _cleanup_close_ int fd = -1;
3877 unsigned n_uids = 0;
70f539ca 3878 size_t sz = 0, l;
0cb9fbcd
LP		 3879 uid_t uid;
3880 gid_t gid;
3881 pid_t pid;
3882 int r;
3883
3884 assert(_home);
3885
3886 if (!arg_user || streq(arg_user, "root") || streq(arg_user, "0")) {
3887 /* Reset everything fully to 0, just in case */
3888
03cfe0d5
LP		 3889 r = reset_uid_gid();
3890 if (r < 0)
3891 return log_error_errno(r, "Failed to become root: %m");
0cb9fbcd
LP		 3892
3893 *_home = NULL;
3894 return 0;
3895 }
3896
3897 /* First, get user credentials */
3898 fd = spawn_getent("passwd", arg_user, &pid);
3899 if (fd < 0)
3900 return fd;
3901
3902 f = fdopen(fd, "r");
3903 if (!f)
3904 return log_oom();
3905 fd = -1;
3906
3907 if (!fgets(line, sizeof(line), f)) {
3908
3909 if (!ferror(f)) {
3910 log_error("Failed to resolve user %s.", arg_user);
3911 return -ESRCH;
3912 }
3913
56f64d95 3914 log_error_errno(errno, "Failed to read from getent: %m");
0cb9fbcd
LP		 3915 return -errno;
3916 }
3917
3918 truncate_nl(line);
3919
820d3acf 3920 wait_for_terminate_and_warn("getent passwd", pid, true);
0cb9fbcd
LP		 3921
3922 x = strchr(line, ':');
3923 if (!x) {
3924 log_error("/etc/passwd entry has invalid user field.");
3925 return -EIO;
3926 }
3927
3928 u = strchr(x+1, ':');
3929 if (!u) {
3930 log_error("/etc/passwd entry has invalid password field.");
3931 return -EIO;
3932 }
3933
3934 u++;
3935 g = strchr(u, ':');
3936 if (!g) {
3937 log_error("/etc/passwd entry has invalid UID field.");
3938 return -EIO;
3939 }
3940
3941 *g = 0;
3942 g++;
3943 x = strchr(g, ':');
3944 if (!x) {
3945 log_error("/etc/passwd entry has invalid GID field.");
3946 return -EIO;
3947 }
3948
3949 *x = 0;
3950 h = strchr(x+1, ':');
3951 if (!h) {
3952 log_error("/etc/passwd entry has invalid GECOS field.");
3953 return -EIO;
3954 }
3955
3956 h++;
3957 x = strchr(h, ':');
3958 if (!x) {
3959 log_error("/etc/passwd entry has invalid home directory field.");
3960 return -EIO;
3961 }
3962
3963 *x = 0;
3964
3965 r = parse_uid(u, &uid);
3966 if (r < 0) {
3967 log_error("Failed to parse UID of user.");
3968 return -EIO;
3969 }
3970
3971 r = parse_gid(g, &gid);
3972 if (r < 0) {
3973 log_error("Failed to parse GID of user.");
3974 return -EIO;
3975 }
3976
3977 home = strdup(h);
3978 if (!home)
3979 return log_oom();
3980
3981 /* Second, get group memberships */
3982 fd = spawn_getent("initgroups", arg_user, &pid);
3983 if (fd < 0)
3984 return fd;
3985
3986 fclose(f);
3987 f = fdopen(fd, "r");
3988 if (!f)
3989 return log_oom();
3990 fd = -1;
3991
3992 if (!fgets(line, sizeof(line), f)) {
3993 if (!ferror(f)) {
3994 log_error("Failed to resolve user %s.", arg_user);
3995 return -ESRCH;
3996 }
3997
56f64d95 3998 log_error_errno(errno, "Failed to read from getent: %m");
0cb9fbcd
LP		 3999 return -errno;
4000 }
4001
4002 truncate_nl(line);
4003
820d3acf 4004 wait_for_terminate_and_warn("getent initgroups", pid, true);
0cb9fbcd
LP		 4005
4006 /* Skip over the username and subsequent separator whitespace */
4007 x = line;
4008 x += strcspn(x, WHITESPACE);
4009 x += strspn(x, WHITESPACE);
4010
a2a5291b 4011 FOREACH_WORD(word, l, x, state) {
0cb9fbcd
LP		 4012 char c[l+1];
4013
a2a5291b 4014 memcpy(c, word, l);
0cb9fbcd
LP		 4015 c[l] = 0;
4016
4017 if (!GREEDY_REALLOC(uids, sz, n_uids+1))
4018 return log_oom();
4019
4020 r = parse_uid(c, &uids[n_uids++]);
4021 if (r < 0) {
4022 log_error("Failed to parse group data from getent.");
4023 return -EIO;
4024 }
4025 }
4026
4027 r = mkdir_parents(home, 0775);
f647962d
MS		 4028 if (r < 0)
4029 return log_error_errno(r, "Failed to make home root directory: %m");
0cb9fbcd
LP		 4030
4031 r = mkdir_safe(home, 0755, uid, gid);
f647962d
MS		 4032 if (r < 0 && r != -EEXIST)
4033 return log_error_errno(r, "Failed to make home directory: %m");
0cb9fbcd 4034
03cfe0d5
LP		 4035 (void) fchown(STDIN_FILENO, uid, gid);
4036 (void) fchown(STDOUT_FILENO, uid, gid);
4037 (void) fchown(STDERR_FILENO, uid, gid);
0cb9fbcd 4038
4a62c710
MS		 4039 if (setgroups(n_uids, uids) < 0)
4040 return log_error_errno(errno, "Failed to set auxiliary groups: %m");
0cb9fbcd 4041
4a62c710
MS		 4042 if (setresgid(gid, gid, gid) < 0)
4043 return log_error_errno(errno, "setregid() failed: %m");
0cb9fbcd 4044
4a62c710
MS		 4045 if (setresuid(uid, uid, uid) < 0)
4046 return log_error_errno(errno, "setreuid() failed: %m");
0cb9fbcd
LP		 4047
4048 if (_home) {
4049 *_home = home;
4050 home = NULL;
4051 }
4052
4053 return 0;
4054}
4055
113cea80 4056/*
6d416b9c
LS		 4057 * Return values:
4058 * < 0 : wait_for_terminate() failed to get the state of the
4059 * container, the container was terminated by a signal, or
4060 * failed for an unknown reason. No change is made to the
4061 * container argument.
4062 * > 0 : The program executed in the container terminated with an
4063 * error. The exit code of the program executed in the
919699ec
LP		 4064 * container is returned. The container argument has been set
4065 * to CONTAINER_TERMINATED.
6d416b9c
LS		 4066 * 0 : The container is being rebooted, has been shut down or exited
4067 * successfully. The container argument has been set to either
4068 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 4069 *
6d416b9c
LS		 4070 * That is, success is indicated by a return value of zero, and an
4071 * error is indicated by a non-zero value.
113cea80
DH		 4072 */
4073static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 4074 siginfo_t status;
919699ec 4075 int r;
113cea80
DH		 4076
4077 r = wait_for_terminate(pid, &status);
f647962d
MS		 4078 if (r < 0)
4079 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 4080
4081 switch (status.si_code) {
fddbb89c 4082
113cea80 4083 case CLD_EXITED:
919699ec
LP		 4084 if (status.si_status == 0) {
4085 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
113cea80 4086
fddbb89c 4087 } else
919699ec 4088 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 4089
919699ec
LP		 4090 *container = CONTAINER_TERMINATED;
4091 return status.si_status;
113cea80
DH		 4092
4093 case CLD_KILLED:
4094 if (status.si_status == SIGINT) {
113cea80 4095
919699ec 4096 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 4097 *container = CONTAINER_TERMINATED;
919699ec
LP		 4098 return 0;
4099
113cea80 4100 } else if (status.si_status == SIGHUP) {
113cea80 4101
919699ec 4102 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 4103 *container = CONTAINER_REBOOTED;
919699ec 4104 return 0;
113cea80 4105 }
919699ec 4106
113cea80
DH		 4107 /* CLD_KILLED fallthrough */
4108
4109 case CLD_DUMPED:
fddbb89c 4110 log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
919699ec 4111 return -EIO;
113cea80
DH		 4112
4113 default:
fddbb89c 4114 log_error("Container %s failed due to unknown reason.", arg_machine);
919699ec 4115 return -EIO;
113cea80
DH		 4116 }
4117
4118 return r;
4119}
4120
e866af3a
DH		 4121static void nop_handler(int sig) {}
4122
023fb90b
LP		 4123static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
4124 pid_t pid;
4125
4126 pid = PTR_TO_UINT32(userdata);
4127 if (pid > 0) {
c6c8f6e2 4128 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 4129 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
4130 sd_event_source_set_userdata(s, NULL);
4131 return 0;
4132 }
4133 }
4134
4135 sd_event_exit(sd_event_source_get_event(s), 0);
4136 return 0;
4137}
4138
ec16945e 4139static int determine_names(void) {
1b9cebf6 4140 int r;
ec16945e 4141
c1521918
LP		 4142 if (arg_template && !arg_directory && arg_machine) {
4143
4144 /* If --template= was specified then we should not
4145 * search for a machine, but instead create a new one
4146 * in /var/lib/machine. */
4147
4148 arg_directory = strjoin("/var/lib/machines/", arg_machine, NULL);
4149 if (!arg_directory)
4150 return log_oom();
4151 }
4152
ec16945e 4153 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 4154 if (arg_machine) {
4155 _cleanup_(image_unrefp) Image *i = NULL;
4156
4157 r = image_find(arg_machine, &i);
4158 if (r < 0)
4159 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
4160 else if (r == 0) {
4161 log_error("No image for machine '%s': %m", arg_machine);
4162 return -ENOENT;
4163 }
4164
aceac2f0 4165 if (i->type == IMAGE_RAW)
1b9cebf6
LP		 4166 r = set_sanitized_path(&arg_image, i->path);
4167 else
4168 r = set_sanitized_path(&arg_directory, i->path);
4169 if (r < 0)
4170 return log_error_errno(r, "Invalid image directory: %m");
4171
aee327b8
LP		 4172 if (!arg_ephemeral)
4173 arg_read_only = arg_read_only || i->read_only;
1b9cebf6 4174 } else
ec16945e
LP		 4175 arg_directory = get_current_dir_name();
4176
1b9cebf6
LP		 4177 if (!arg_directory && !arg_machine) {
4178 log_error("Failed to determine path, please use -D or -i.");
ec16945e
LP		 4179 return -EINVAL;
4180 }
4181 }
4182
4183 if (!arg_machine) {
b9ba4dab
LP		 4184 if (arg_directory && path_equal(arg_directory, "/"))
4185 arg_machine = gethostname_malloc();
4186 else
4187 arg_machine = strdup(basename(arg_image ?: arg_directory));
4188
ec16945e
LP		 4189 if (!arg_machine)
4190 return log_oom();
4191
ae691c1d 4192 hostname_cleanup(arg_machine);
ec16945e
LP		 4193 if (!machine_name_is_valid(arg_machine)) {
4194 log_error("Failed to determine machine name automatically, please use -M.");
4195 return -EINVAL;
4196 }
b9ba4dab
LP		 4197
4198 if (arg_ephemeral) {
4199 char *b;
4200
4201 /* Add a random suffix when this is an
4202 * ephemeral machine, so that we can run many
4203 * instances at once without manually having
4204 * to specify -M each time. */
4205
4206 if (asprintf(&b, "%s-%016" PRIx64, arg_machine, random_u64()) < 0)
4207 return log_oom();
4208
4209 free(arg_machine);
4210 arg_machine = b;
4211 }
ec16945e
LP		 4212 }
4213
4214 return 0;
4215}
4216
03cfe0d5 4217static int determine_uid_shift(const char *directory) {
6dac160c
LP		 4218 int r;
4219
03cfe0d5
LP		 4220 if (!arg_userns) {
4221 arg_uid_shift = 0;
6dac160c 4222 return 0;
03cfe0d5 4223 }
6dac160c
LP		 4224
4225 if (arg_uid_shift == UID_INVALID) {
4226 struct stat st;
4227
03cfe0d5 4228 r = stat(directory, &st);
6dac160c 4229 if (r < 0)
03cfe0d5 4230 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 4231
4232 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
4233
4234 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000))) {
03cfe0d5 4235 log_error("UID and GID base of %s don't match.", directory);
6dac160c
LP		 4236 return -EINVAL;
4237 }
4238
4239 arg_uid_range = UINT32_C(0x10000);
4240 }
4241
4242 if (arg_uid_shift > (uid_t) -1 - arg_uid_range) {
4243 log_error("UID base too high for UID range.");
4244 return -EINVAL;
4245 }
4246
4247 log_info("Using user namespaces with base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
4248 return 0;
4249}
4250
03cfe0d5
LP		 4251static int inner_child(
4252 Barrier *barrier,
4253 const char *directory,
4254 bool secondary,
4255 int kmsg_socket,
4256 int rtnl_socket,
4257 FDSet *fds,
4258 int argc,
4259 char *argv[]) {
69c79d3c 4260
03cfe0d5
LP		 4261 _cleanup_free_ char *home = NULL;
4262 unsigned n_env = 2;
4263 const char *envp[] = {
4264 "PATH=" DEFAULT_PATH_SPLIT_USR,
4265 "container=systemd-nspawn", /* LXC sets container=lxc, so follow the scheme here */
4266 NULL, /* TERM */
4267 NULL, /* HOME */
4268 NULL, /* USER */
4269 NULL, /* LOGNAME */
4270 NULL, /* container_uuid */
4271 NULL, /* LISTEN_FDS */
4272 NULL, /* LISTEN_PID */
4273 NULL
4274 };
88213476 4275
2371271c 4276 _cleanup_strv_free_ char **env_use = NULL;
03cfe0d5 4277 int r;
88213476 4278
03cfe0d5
LP		 4279 assert(barrier);
4280 assert(directory);
4281 assert(kmsg_socket >= 0);
88213476 4282
efdb0237
LP		 4283 cg_unified_flush();
4284
03cfe0d5
LP		 4285 if (arg_userns) {
4286 /* Tell the parent, that it now can write the UID map. */
4287 (void) barrier_place(barrier); /* #1 */
7027ff61 4288
03cfe0d5
LP		 4289 /* Wait until the parent wrote the UID map */
4290 if (!barrier_place_and_sync(barrier)) { /* #2 */
4291 log_error("Parent died too early");
4292 return -ESRCH;
4293 }
88213476
LP		 4294 }
4295
03cfe0d5
LP		 4296 r = mount_all(NULL, true);
4297 if (r < 0)
4298 return r;
4299
4300 /* Wait until we are cgroup-ified, so that we
4301 * can mount the right cgroup path writable */
4302 if (!barrier_place_and_sync(barrier)) { /* #3 */
4303 log_error("Parent died too early");
4304 return -ESRCH;
88213476
LP		 4305 }
4306
03cfe0d5
LP		 4307 r = mount_systemd_cgroup_writable("");
4308 if (r < 0)
4309 return r;
ec16945e 4310
03cfe0d5
LP		 4311 r = reset_uid_gid();
4312 if (r < 0)
4313 return log_error_errno(r, "Couldn't become new root: %m");
1b9e5b12 4314
03cfe0d5
LP		 4315 r = setup_boot_id(NULL);
4316 if (r < 0)
4317 return r;
ec16945e 4318
03cfe0d5
LP		 4319 r = setup_kmsg(NULL, kmsg_socket);
4320 if (r < 0)
4321 return r;
4322 kmsg_socket = safe_close(kmsg_socket);
ec16945e 4323
03cfe0d5 4324 umask(0022);
30535c16 4325
03cfe0d5
LP		 4326 if (setsid() < 0)
4327 return log_error_errno(errno, "setsid() failed: %m");
4328
4329 if (arg_private_network)
4330 loopback_setup();
4331
4332 r = send_rtnl(rtnl_socket);
4333 if (r < 0)
4334 return r;
4335 rtnl_socket = safe_close(rtnl_socket);
4336
4337 if (drop_capabilities() < 0)
4338 return log_error_errno(errno, "drop_capabilities() failed: %m");
4339
4340 setup_hostname();
4341
050f7277 4342 if (arg_personality != PERSONALITY_INVALID) {
03cfe0d5
LP		 4343 if (personality(arg_personality) < 0)
4344 return log_error_errno(errno, "personality() failed: %m");
4345 } else if (secondary) {
4346 if (personality(PER_LINUX32) < 0)
4347 return log_error_errno(errno, "personality() failed: %m");
4348 }
4349
4350#ifdef HAVE_SELINUX
4351 if (arg_selinux_context)
4352 if (setexeccon((security_context_t) arg_selinux_context) < 0)
4353 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
4354#endif
4355
4356 r = change_uid_gid(&home);
4357 if (r < 0)
4358 return r;
4359
4360 envp[n_env] = strv_find_prefix(environ, "TERM=");
4361 if (envp[n_env])
4362 n_env ++;
4363
4364 if ((asprintf((char**)(envp + n_env++), "HOME=%s", home ? home: "/root") < 0) ||
4365 (asprintf((char**)(envp + n_env++), "USER=%s", arg_user ? arg_user : "root") < 0) ||
4366 (asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0))
4367 return log_oom();
4368
4369 if (!sd_id128_equal(arg_uuid, SD_ID128_NULL)) {
4370 char as_uuid[37];
4371
4372 if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0)
4373 return log_oom();
4374 }
4375
4376 if (fdset_size(fds) > 0) {
4377 r = fdset_cloexec(fds, false);
4378 if (r < 0)
4379 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
4380
4381 if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
4382 (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0))
4383 return log_oom();
4384 }
4385
2371271c
TG		 4386 env_use = strv_env_merge(2, envp, arg_setenv);
4387 if (!env_use)
4388 return log_oom();
03cfe0d5
LP		 4389
4390 /* Let the parent know that we are ready and
4391 * wait until the parent is ready with the
4392 * setup, too... */
4393 if (!barrier_place_and_sync(barrier)) { /* #4 */
4394 log_error("Parent died too early");
4395 return -ESRCH;
4396 }
4397
4398 /* Now, explicitly close the log, so that we
4399 * then can close all remaining fds. Closing
4400 * the log explicitly first has the benefit
4401 * that the logging subsystem knows about it,
4402 * and is thus ready to be reopened should we
4403 * need it again. Note that the other fds
4404 * closed here are at least the locking and
4405 * barrier fds. */
4406 log_close();
4407 (void) fdset_close_others(fds);
4408
4409 if (arg_boot) {
4410 char **a;
4411 size_t m;
4412
4413 /* Automatically search for the init system */
4414
4415 m = 1 + argc - optind;
4416 a = newa(char*, m + 1);
4417 memcpy(a + 1, argv + optind, m * sizeof(char*));
4418
4419 a[0] = (char*) "/usr/lib/systemd/systemd";
4420 execve(a[0], a, env_use);
4421
4422 a[0] = (char*) "/lib/systemd/systemd";
4423 execve(a[0], a, env_use);
4424
4425 a[0] = (char*) "/sbin/init";
4426 execve(a[0], a, env_use);
4427 } else if (argc > optind)
4428 execvpe(argv[optind], argv + optind, env_use);
4429 else {
4430 chdir(home ? home : "/root");
4431 execle("/bin/bash", "-bash", NULL, env_use);
4432 execle("/bin/sh", "-sh", NULL, env_use);
4433 }
4434
4435 (void) log_open();
4436 return log_error_errno(errno, "execv() failed: %m");
4437}
4438
4439static int outer_child(
4440 Barrier *barrier,
4441 const char *directory,
4442 const char *console,
4443 const char *root_device, bool root_device_rw,
4444 const char *home_device, bool home_device_rw,
4445 const char *srv_device, bool srv_device_rw,
4446 bool interactive,
4447 bool secondary,
4448 int pid_socket,
4449 int kmsg_socket,
4450 int rtnl_socket,
825d5287 4451 int uid_shift_socket,
03cfe0d5
LP		 4452 FDSet *fds,
4453 int argc,
4454 char *argv[]) {
4455
4456 pid_t pid;
4457 ssize_t l;
4458 int r;
4459
4460 assert(barrier);
4461 assert(directory);
4462 assert(console);
4463 assert(pid_socket >= 0);
4464 assert(kmsg_socket >= 0);
4465
efdb0237
LP		 4466 cg_unified_flush();
4467
03cfe0d5
LP		 4468 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
4469 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
4470
4471 if (interactive) {
4472 close_nointr(STDIN_FILENO);
4473 close_nointr(STDOUT_FILENO);
4474 close_nointr(STDERR_FILENO);
4475
4476 r = open_terminal(console, O_RDWR);
4477 if (r != STDIN_FILENO) {
4478 if (r >= 0) {
4479 safe_close(r);
4480 r = -EINVAL;
4481 }
4482
4483 return log_error_errno(r, "Failed to open console: %m");
4484 }
4485
4486 if (dup2(STDIN_FILENO, STDOUT_FILENO) != STDOUT_FILENO ||
4487 dup2(STDIN_FILENO, STDERR_FILENO) != STDERR_FILENO)
4488 return log_error_errno(errno, "Failed to duplicate console: %m");
4489 }
4490
4491 r = reset_audit_loginuid();
4492 if (r < 0)
4493 return r;
4494
4495 /* Mark everything as slave, so that we still
4496 * receive mounts from the real root, but don't
4497 * propagate mounts to the real root. */
4498 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0)
4499 return log_error_errno(errno, "MS_SLAVE|MS_REC failed: %m");
4500
4501 r = mount_devices(directory,
4502 root_device, root_device_rw,
4503 home_device, home_device_rw,
4504 srv_device, srv_device_rw);
4505 if (r < 0)
4506 return r;
4507
391567f4
LP		 4508 r = determine_uid_shift(directory);
4509 if (r < 0)
4510 return r;
4511
825d5287
RM		 4512 if (arg_userns) {
4513 l = send(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
4514 if (l < 0)
4515 return log_error_errno(errno, "Failed to send UID shift: %m");
4516 if (l != sizeof(arg_uid_shift)) {
4517 log_error("Short write while sending UID shift.");
4518 return -EIO;
4519 }
4520 }
4521
03cfe0d5
LP		 4522 /* Turn directory into bind mount */
4523 if (mount(directory, directory, NULL, MS_BIND|MS_REC, NULL) < 0)
4524 return log_error_errno(errno, "Failed to make bind mount: %m");
4525
03cfe0d5
LP		 4526 r = setup_volatile(directory);
4527 if (r < 0)
4528 return r;
4529
03cfe0d5
LP		 4530 r = setup_volatile_state(directory);
4531 if (r < 0)
4532 return r;
4533
03cfe0d5
LP		 4534 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
4535 if (r < 0)
4536 return r;
4537
03cfe0d5
LP		 4538 if (arg_read_only) {
4539 r = bind_remount_recursive(directory, true);
4540 if (r < 0)
4541 return log_error_errno(r, "Failed to make tree read-only: %m");
4542 }
4543
03cfe0d5
LP		 4544 r = mount_all(directory, false);
4545 if (r < 0)
4546 return r;
4547
4548 if (copy_devnodes(directory) < 0)
4549 return r;
4550
4551 dev_setup(directory, arg_uid_shift, arg_uid_shift);
4552
4553 if (setup_pts(directory) < 0)
4554 return r;
4555
4556 r = setup_propagate(directory);
4557 if (r < 0)
4558 return r;
4559
4560 r = setup_dev_console(directory, console);
4561 if (r < 0)
4562 return r;
4563
4564 r = setup_seccomp();
4565 if (r < 0)
4566 return r;
4567
4568 r = setup_timezone(directory);
4569 if (r < 0)
4570 return r;
4571
4572 r = setup_resolv_conf(directory);
4573 if (r < 0)
4574 return r;
4575
4576 r = setup_journal(directory);
4577 if (r < 0)
4578 return r;
4579
4580 r = mount_custom(directory);
4581 if (r < 0)
4582 return r;
4583
efdb0237 4584 r = mount_cgroups(directory);
03cfe0d5
LP		 4585 if (r < 0)
4586 return r;
4587
4588 r = mount_move_root(directory);
4589 if (r < 0)
4590 return log_error_errno(r, "Failed to move root directory: %m");
4591
4592 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
4593 (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS) |
4594 (arg_private_network ? CLONE_NEWNET : 0) |
4595 (arg_userns ? CLONE_NEWUSER : 0),
4596 NULL);
4597 if (pid < 0)
4598 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5
LP		 4599 if (pid == 0) {
4600 pid_socket = safe_close(pid_socket);
825d5287 4601 uid_shift_socket = safe_close(uid_shift_socket);
03cfe0d5
LP		 4602
4603 /* The inner child has all namespaces that are
4604 * requested, so that we all are owned by the user if
4605 * user namespaces are turned on. */
4606
4607 r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, fds, argc, argv);
4608 if (r < 0)
4609 _exit(EXIT_FAILURE);
4610
4611 _exit(EXIT_SUCCESS);
4612 }
4613
4614 l = send(pid_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
4615 if (l < 0)
4616 return log_error_errno(errno, "Failed to send PID: %m");
4617 if (l != sizeof(pid)) {
4618 log_error("Short write while sending PID.");
4619 return -EIO;
4620 }
4621
4622 pid_socket = safe_close(pid_socket);
4623
4624 return 0;
4625}
4626
4627static int setup_uid_map(pid_t pid) {
4628 char uid_map[strlen("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1], line[DECIMAL_STR_MAX(uid_t)*3+3+1];
4629 int r;
4630
4631 assert(pid > 1);
4632
4633 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
4634 xsprintf(line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, arg_uid_shift, arg_uid_range);
ad118bda 4635 r = write_string_file(uid_map, line, 0);
03cfe0d5
LP		 4636 if (r < 0)
4637 return log_error_errno(r, "Failed to write UID map: %m");
4638
4639 /* We always assign the same UID and GID ranges */
4640 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
ad118bda 4641 r = write_string_file(uid_map, line, 0);
03cfe0d5
LP		 4642 if (r < 0)
4643 return log_error_errno(r, "Failed to write GID map: %m");
4644
4645 return 0;
4646}
4647
4648static int chown_cgroup(pid_t pid) {
4649 _cleanup_free_ char *path = NULL, *fs = NULL;
4650 _cleanup_close_ int fd = -1;
4651 const char *fn;
4652 int r;
4653
4654 r = cg_pid_get_path(NULL, pid, &path);
4655 if (r < 0)
4656 return log_error_errno(r, "Failed to get container cgroup path: %m");
4657
4658 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, path, NULL, &fs);
4659 if (r < 0)
4660 return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
4661
4662 fd = open(fs, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
4663 if (fd < 0)
4664 return log_error_errno(errno, "Failed to open %s: %m", fs);
4665
efdb0237
LP		 4666 FOREACH_STRING(fn,
4667 ".",
4668 "tasks",
4669 "notify_on_release",
4670 "cgroup.procs",
4671 "cgroup.clone_children",
4672 "cgroup.controllers",
4673 "cgroup.subtree_control",
4674 "cgroup.populated")
03cfe0d5 4675 if (fchownat(fd, fn, arg_uid_shift, arg_uid_shift, 0) < 0)
efdb0237
LP		 4676 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
4677 "Failed to chown() cgroup file %s, ignoring: %m", fn);
4678
4679 return 0;
4680}
4681
4682static int sync_cgroup(pid_t pid) {
4683 _cleanup_free_ char *cgroup = NULL;
4684 char tree[] = "/tmp/unifiedXXXXXX", pid_string[DECIMAL_STR_MAX(pid) + 1];
4685 bool undo_mount = false;
4686 const char *fn;
4687 int unified, r;
4688
4689 unified = cg_unified();
4690 if (unified < 0)
4691 return log_error_errno(unified, "Failed to determine whether the unified hierachy is used: %m");
4692
4693 if ((unified > 0) == arg_unified_cgroup_hierarchy)
4694 return 0;
4695
4696 /* When the host uses the legacy cgroup setup, but the
4697 * container shall use the unified hierarchy, let's make sure
4698 * we copy the path from the name=systemd hierarchy into the
4699 * unified hierarchy. Similar for the reverse situation. */
4700
4701 r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
4702 if (r < 0)
4703 return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid);
4704
4705 /* In order to access the unified hierarchy we need to mount it */
4706 if (!mkdtemp(tree))
4707 return log_error_errno(errno, "Failed to generate temporary mount point for unified hierarchy: %m");
4708
4709 if (unified)
4710 r = mount("cgroup", tree, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr");
4711 else
4712 r = mount("cgroup", tree, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV, "__DEVEL__sane_behavior");
4713 if (r < 0) {
4714 r = log_error_errno(errno, "Failed to mount unified hierarchy: %m");
4715 goto finish;
4716 }
4717
4718 undo_mount = true;
4719
4720 fn = strjoina(tree, cgroup, "/cgroup.procs");
4721 (void) mkdir_parents(fn, 0755);
4722
4723 sprintf(pid_string, PID_FMT, pid);
4724 r = write_string_file(fn, pid_string, 0);
4725 if (r < 0)
4726 log_error_errno(r, "Failed to move process: %m");
4727
4728finish:
4729 if (undo_mount)
4730 (void) umount(tree);
4731
4732 (void) rmdir(tree);
4733 return r;
4734}
4735
4736static int create_subcgroup(pid_t pid) {
4737 _cleanup_free_ char *cgroup = NULL;
4738 const char *child;
4739 int unified, r;
98e4d8d7 4740 CGroupMask supported;
efdb0237
LP		 4741
4742 /* In the unified hierarchy inner nodes may only only contain
4743 * subgroups, but not processes. Hence, if we running in the
4744 * unified hierarchy and the container does the same, and we
4745 * did not create a scope unit for the container move us and
4746 * the container into two separate subcgroups. */
4747
4748 if (!arg_keep_unit)
4749 return 0;
4750
4751 if (!arg_unified_cgroup_hierarchy)
4752 return 0;
4753
4754 unified = cg_unified();
4755 if (unified < 0)
4756 return log_error_errno(unified, "Failed to determine whether the unified hierachy is used: %m");
4757 if (unified == 0)
4758 return 0;
4759
98e4d8d7
LP		 4760 r = cg_mask_supported(&supported);
4761 if (r < 0)
4762 return log_error_errno(r, "Failed to determine supported controllers: %m");
4763
efdb0237
LP		 4764 r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &cgroup);
4765 if (r < 0)
4766 return log_error_errno(r, "Failed to get our control group: %m");
4767
4768 child = strjoina(cgroup, "/payload");
4769 r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, pid);
4770 if (r < 0)
4771 return log_error_errno(r, "Failed to create %s subcgroup: %m", child);
4772
4773 child = strjoina(cgroup, "/supervisor");
4774 r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, 0);
4775 if (r < 0)
4776 return log_error_errno(r, "Failed to create %s subcgroup: %m", child);
03cfe0d5 4777
98e4d8d7
LP		 4778 /* Try to enable as many controllers as possible for the new payload. */
4779 (void) cg_enable_everywhere(supported, supported, cgroup);
03cfe0d5
LP		 4780 return 0;
4781}
4782
4783int main(int argc, char *argv[]) {
4784
4785 _cleanup_free_ char *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL, *console = NULL;
4786 bool root_device_rw = true, home_device_rw = true, srv_device_rw = true;
4787 _cleanup_close_ int master = -1, image_fd = -1;
4788 _cleanup_fdset_free_ FDSet *fds = NULL;
4789 int r, n_fd_passed, loop_nr = -1;
4790 char veth_name[IFNAMSIZ];
4791 bool secondary = false, remove_subvol = false;
72c0a2c2 4792 sigset_t mask_chld;
03cfe0d5
LP		 4793 pid_t pid = 0;
4794 int ret = EXIT_SUCCESS;
4795 union in_addr_union exposed = {};
4796 _cleanup_release_lock_file_ LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
4797 bool interactive;
4798
4799 log_parse_environment();
4800 log_open();
4801
4802 r = parse_argv(argc, argv);
4803 if (r <= 0)
4804 goto finish;
4805
4806 r = determine_names();
4807 if (r < 0)
4808 goto finish;
4809
4810 if (geteuid() != 0) {
4811 log_error("Need to be root.");
4812 r = -EPERM;
4813 goto finish;
4814 }
4815
4816 n_fd_passed = sd_listen_fds(false);
4817 if (n_fd_passed > 0) {
4818 r = fdset_new_listen_fds(&fds, false);
4819 if (r < 0) {
4820 log_error_errno(r, "Failed to collect file descriptors: %m");
4821 goto finish;
4822 }
4823 }
4824
4825 if (arg_directory) {
4826 assert(!arg_image);
4827
4828 if (path_equal(arg_directory, "/") && !arg_ephemeral) {
4829 log_error("Spawning container on root directory is not supported. Consider using --ephemeral.");
4830 r = -EINVAL;
4831 goto finish;
4832 }
4833
4834 if (arg_ephemeral) {
4835 _cleanup_free_ char *np = NULL;
4836
4837 /* If the specified path is a mount point we
4838 * generate the new snapshot immediately
4839 * inside it under a random name. However if
4840 * the specified is not a mount point we
4841 * create the new snapshot in the parent
4842 * directory, just next to it. */
e26d6ce5 4843 r = path_is_mount_point(arg_directory, 0);
03cfe0d5
LP		 4844 if (r < 0) {
4845 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
4846 goto finish;
4847 }
4848 if (r > 0)
770b5ce4 4849 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 4850 else
770b5ce4 4851 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5
LP		 4852 if (r < 0) {
4853 log_error_errno(r, "Failed to generate name for snapshot: %m");
4854 goto finish;
4855 }
4856
4857 r = image_path_lock(np, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
4858 if (r < 0) {
4859 log_error_errno(r, "Failed to lock %s: %m", np);
4860 goto finish;
4861 }
4862
4863 r = btrfs_subvol_snapshot(arg_directory, np, (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) | BTRFS_SNAPSHOT_FALLBACK_COPY | BTRFS_SNAPSHOT_RECURSIVE);
4864 if (r < 0) {
4865 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
4866 goto finish;
ec16945e
LP		 4867 }
4868
4869 free(arg_directory);
4870 arg_directory = np;
8a16a7b4 4871 np = NULL;
ec16945e
LP		 4872
4873 remove_subvol = true;
30535c16
LP		 4874
4875 } else {
4876 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
4877 if (r == -EBUSY) {
4878 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
4879 goto finish;
4880 }
4881 if (r < 0) {
4882 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
4883 return r;
4884 }
4885
4886 if (arg_template) {
f70a17f8 4887 r = btrfs_subvol_snapshot(arg_template, arg_directory, (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) | BTRFS_SNAPSHOT_FALLBACK_COPY | BTRFS_SNAPSHOT_RECURSIVE);
30535c16
LP		 4888 if (r == -EEXIST) {
4889 if (!arg_quiet)
4890 log_info("Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
4891 } else if (r < 0) {
83521414 4892 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16
LP		 4893 goto finish;
4894 } else {
4895 if (!arg_quiet)
4896 log_info("Populated %s from template %s.", arg_directory, arg_template);
4897 }
4898 }
ec16945e
LP		 4899 }
4900
1b9e5b12
LP		 4901 if (arg_boot) {
4902 if (path_is_os_tree(arg_directory) <= 0) {
5ae4d543 4903 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory);
ec16945e 4904 r = -EINVAL;
1b9e5b12
LP		 4905 goto finish;
4906 }
4907 } else {
4908 const char *p;
4909
63c372cb 4910 p = strjoina(arg_directory,
1b9e5b12
LP		 4911 argc > optind && path_is_absolute(argv[optind]) ? argv[optind] : "/usr/bin/");
4912 if (access(p, F_OK) < 0) {
4913 log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory);
ec16945e 4914 r = -EINVAL;
1b9e5b12 4915 goto finish;
1b9e5b12
LP		 4916 }
4917 }
ec16945e 4918
6b9132a9 4919 } else {
1b9e5b12 4920 char template[] = "/tmp/nspawn-root-XXXXXX";
6b9132a9 4921
ec16945e
LP		 4922 assert(arg_image);
4923 assert(!arg_template);
4924
30535c16
LP		 4925 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
4926 if (r == -EBUSY) {
4927 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
4928 goto finish;
4929 }
4930 if (r < 0) {
4931 r = log_error_errno(r, "Failed to create image lock: %m");
4932 goto finish;
4933 }
4934
1b9e5b12 4935 if (!mkdtemp(template)) {
56f64d95 4936 log_error_errno(errno, "Failed to create temporary directory: %m");
1b9e5b12 4937 r = -errno;
6b9132a9 4938 goto finish;
1b9e5b12 4939 }
6b9132a9 4940
1b9e5b12
LP		 4941 arg_directory = strdup(template);
4942 if (!arg_directory) {
4943 r = log_oom();
4944 goto finish;
6b9132a9 4945 }
88213476 4946
1b9e5b12
LP		 4947 image_fd = setup_image(&device_path, &loop_nr);
4948 if (image_fd < 0) {
4949 r = image_fd;
842f3b0f
LP		 4950 goto finish;
4951 }
1b9e5b12 4952
4d9f07b4
LP		 4953 r = dissect_image(image_fd,
4954 &root_device, &root_device_rw,
4955 &home_device, &home_device_rw,
4956 &srv_device, &srv_device_rw,
4957 &secondary);
1b9e5b12
LP		 4958 if (r < 0)
4959 goto finish;
842f3b0f 4960 }
842f3b0f 4961
5a8af538
LP		 4962 r = custom_mounts_prepare();
4963 if (r < 0)
4964 goto finish;
4965
03cfe0d5
LP		 4966 interactive =
4967 isatty(STDIN_FILENO) > 0 &&
4968 isatty(STDOUT_FILENO) > 0;
9c857b9d 4969
db7feb7e
LP		 4970 master = posix_openpt(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY);
4971 if (master < 0) {
ec16945e 4972 r = log_error_errno(errno, "Failed to acquire pseudo tty: %m");
a258bf26
LP		 4973 goto finish;
4974 }
4975
611b312b
LP		 4976 r = ptsname_malloc(master, &console);
4977 if (r < 0) {
4978 r = log_error_errno(r, "Failed to determine tty name: %m");
a258bf26
LP		 4979 goto finish;
4980 }
4981
a258bf26 4982 if (unlockpt(master) < 0) {
ec16945e 4983 r = log_error_errno(errno, "Failed to unlock tty: %m");
a258bf26
LP		 4984 goto finish;
4985 }
4986
9c857b9d
LP		 4987 if (!arg_quiet)
4988 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
4989 arg_machine, arg_image ?: arg_directory);
4990
72c0a2c2 4991 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
a258bf26 4992
023fb90b
LP		 4993 assert_se(sigemptyset(&mask_chld) == 0);
4994 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4995
03cfe0d5
LP		 4996 if (prctl(PR_SET_CHILD_SUBREAPER, 1) < 0) {
4997 r = log_error_errno(errno, "Failed to become subreaper: %m");
4998 goto finish;
4999 }
5000
d87be9b0 5001 for (;;) {
825d5287
RM		 5002 _cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 }, rtnl_socket_pair[2] = { -1, -1 }, pid_socket_pair[2] = { -1, -1 },
5003 uid_shift_socket_pair[2] = { -1, -1 };
113cea80 5004 ContainerStatus container_status;
7566e267 5005 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
03cfe0d5 5006 static const struct sigaction sa = {
e866af3a
DH		 5007 .sa_handler = nop_handler,
5008 .sa_flags = SA_NOCLDSTOP,
5009 };
03cfe0d5
LP		 5010 int ifi = 0;
5011 ssize_t l;
dbb60d69
LP		 5012 _cleanup_event_unref_ sd_event *event = NULL;
5013 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
5014 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
5015 char last_char = 0;
e866af3a 5016
7566e267 5017 r = barrier_create(&barrier);
a2da110b 5018 if (r < 0) {
da927ba9 5019 log_error_errno(r, "Cannot initialize IPC barrier: %m");
a2da110b
DH		 5020 goto finish;
5021 }
5022
6d0b55c2
LP		 5023 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0) {
5024 r = log_error_errno(errno, "Failed to create kmsg socket pair: %m");
5025 goto finish;
5026 }
5027
5028 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, rtnl_socket_pair) < 0) {
5029 r = log_error_errno(errno, "Failed to create rtnl socket pair: %m");
5030 goto finish;
5031 }
5032
03cfe0d5
LP		 5033 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, pid_socket_pair) < 0) {
5034 r = log_error_errno(errno, "Failed to create pid socket pair: %m");
5035 goto finish;
5036 }
5037
825d5287
RM		 5038 if (arg_userns)
5039 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, uid_shift_socket_pair) < 0) {
5040 r = log_error_errno(errno, "Failed to create uid shift socket pair: %m");
5041 goto finish;
5042 }
5043
e866af3a
DH		 5044 /* Child can be killed before execv(), so handle SIGCHLD
5045 * in order to interrupt parent's blocking calls and
5046 * give it a chance to call wait() and terminate. */
5047 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
5048 if (r < 0) {
ec16945e 5049 r = log_error_errno(errno, "Failed to change the signal mask: %m");
d96c1ecf
LP		 5050 goto finish;
5051 }
5052
e866af3a
DH		 5053 r = sigaction(SIGCHLD, &sa, NULL);
5054 if (r < 0) {
ec16945e 5055 r = log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
40ddbdf8
LP		 5056 goto finish;
5057 }
5058
03cfe0d5 5059 pid = raw_clone(SIGCHLD|CLONE_NEWNS, NULL);
d87be9b0
LP		 5060 if (pid < 0) {
5061 if (errno == EINVAL)
ec16945e 5062 r = log_error_errno(errno, "clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
d87be9b0 5063 else
ec16945e 5064 r = log_error_errno(errno, "clone() failed: %m");
a258bf26 5065
d87be9b0
LP		 5066 goto finish;
5067 }
a258bf26 5068
d87be9b0 5069 if (pid == 0) {
03cfe0d5 5070 /* The outer child only has a file system namespace. */
a2da110b
DH		 5071 barrier_set_role(&barrier, BARRIER_CHILD);
5072
03e334a1 5073 master = safe_close(master);
a258bf26 5074
03e334a1 5075 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
6d0b55c2 5076 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
03cfe0d5 5077 pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
825d5287 5078 uid_shift_socket_pair[0] = safe_close(uid_shift_socket_pair[0]);
a258bf26 5079
ce30c8dc
LP		 5080 (void) reset_all_signal_handlers();
5081 (void) reset_signal_mask();
f5c1b9ee 5082
03cfe0d5
LP		 5083 r = outer_child(&barrier,
5084 arg_directory,
5085 console,
5086 root_device, root_device_rw,
5087 home_device, home_device_rw,
5088 srv_device, srv_device_rw,
5089 interactive,
5090 secondary,
5091 pid_socket_pair[1],
5092 kmsg_socket_pair[1],
5093 rtnl_socket_pair[1],
825d5287 5094 uid_shift_socket_pair[1],
03cfe0d5
LP		 5095 fds,
5096 argc, argv);
0cb9fbcd 5097 if (r < 0)
a2da110b 5098 _exit(EXIT_FAILURE);
d87be9b0 5099
03cfe0d5 5100 _exit(EXIT_SUCCESS);
da5b3bad 5101 }
88213476 5102
a2da110b 5103 barrier_set_role(&barrier, BARRIER_PARENT);
03cfe0d5 5104
842f3b0f
LP		 5105 fdset_free(fds);
5106 fds = NULL;
5107
6d0b55c2
LP		 5108 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
5109 rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
03cfe0d5 5110 pid_socket_pair[1] = safe_close(pid_socket_pair[1]);
6d0b55c2 5111
03cfe0d5
LP		 5112 /* Wait for the outer child. */
5113 r = wait_for_terminate_and_warn("namespace helper", pid, NULL);
5114 if (r < 0)
5115 goto finish;
5116 if (r != 0) {
5117 r = -EIO;
5118 goto finish;
5119 }
5120 pid = 0;
6dac160c 5121
03cfe0d5
LP		 5122 /* And now retrieve the PID of the inner child. */
5123 l = recv(pid_socket_pair[0], &pid, sizeof(pid), 0);
5124 if (l < 0) {
5125 r = log_error_errno(errno, "Failed to read inner child PID: %m");
5126 goto finish;
5127 }
5128 if (l != sizeof(pid)) {
5129 log_error("Short read while reading inner child PID: %m");
5130 r = EIO;
5131 goto finish;
5132 }
354bfd2b 5133
03cfe0d5 5134 log_debug("Init process invoked as PID " PID_FMT, pid);
aa28aefe 5135
03cfe0d5
LP		 5136 if (arg_userns) {
5137 if (!barrier_place_and_sync(&barrier)) { /* #1 */
5138 log_error("Child died too early.");
5139 r = -ESRCH;
840295fc 5140 goto finish;
03cfe0d5 5141 }
ab046dde 5142
825d5287
RM		 5143 l = recv(uid_shift_socket_pair[0], &arg_uid_shift, sizeof(arg_uid_shift), 0);
5144 if (l < 0) {
5145 r = log_error_errno(errno, "Failed to read UID shift: %m");
5146 goto finish;
5147 }
5148 if (l != sizeof(arg_uid_shift)) {
5149 log_error("Short read while reading UID shift: %m");
5150 r = EIO;
5151 goto finish;
5152 }
5153
03cfe0d5 5154 r = setup_uid_map(pid);
840295fc
LP		 5155 if (r < 0)
5156 goto finish;
ab046dde 5157
03cfe0d5
LP		 5158 (void) barrier_place(&barrier); /* #2 */
5159 }
c74e630d 5160
03cfe0d5
LP		 5161 r = move_network_interfaces(pid);
5162 if (r < 0)
5163 goto finish;
4bbfe7ad 5164
03cfe0d5
LP		 5165 r = setup_veth(pid, veth_name, &ifi);
5166 if (r < 0)
5167 goto finish;
5aa4bb6b 5168
03cfe0d5
LP		 5169 r = setup_bridge(veth_name, &ifi);
5170 if (r < 0)
5171 goto finish;
6dac160c 5172
03cfe0d5
LP		 5173 r = setup_macvlan(pid);
5174 if (r < 0)
5175 goto finish;
6dac160c 5176
03cfe0d5
LP		 5177 r = setup_ipvlan(pid);
5178 if (r < 0)
5179 goto finish;
6dac160c 5180
03cfe0d5
LP		 5181 r = register_machine(pid, ifi);
5182 if (r < 0)
5183 goto finish;
6dac160c 5184
efdb0237
LP		 5185 r = sync_cgroup(pid);
5186 if (r < 0)
5187 goto finish;
5188
5189 r = create_subcgroup(pid);
5190 if (r < 0)
5191 goto finish;
5192
03cfe0d5
LP		 5193 r = chown_cgroup(pid);
5194 if (r < 0)
5195 goto finish;
6dac160c 5196
03cfe0d5
LP		 5197 /* Notify the child that the parent is ready with all
5198 * its setup (including cgroup-ification), and that
5199 * the child can now hand over control to the code to
5200 * run inside the container. */
5201 (void) barrier_place(&barrier); /* #3 */
6dac160c 5202
03cfe0d5
LP		 5203 /* Block SIGCHLD here, before notifying child.
5204 * process_pty() will handle it with the other signals. */
5205 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
e866af3a 5206
03cfe0d5
LP		 5207 /* Reset signal to default */
5208 r = default_signals(SIGCHLD, -1);
5209 if (r < 0) {
5210 log_error_errno(r, "Failed to reset SIGCHLD: %m");
5211 goto finish;
5212 }
e866af3a 5213
03cfe0d5
LP		 5214 /* Let the child know that we are ready and wait that the child is completely ready now. */
5215 if (!barrier_place_and_sync(&barrier)) { /* #5 */
5216 log_error("Client died too early.");
5217 r = -ESRCH;
5218 goto finish;
5219 }
b12afc8c 5220
03cfe0d5
LP		 5221 sd_notifyf(false,
5222 "READY=1\n"
5223 "STATUS=Container running.\n"
5224 "X_NSPAWN_LEADER_PID=" PID_FMT, pid);
354bfd2b 5225
03cfe0d5
LP		 5226 r = sd_event_new(&event);
5227 if (r < 0) {
5228 log_error_errno(r, "Failed to get default event source: %m");
5229 goto finish;
5230 }
88213476 5231
03cfe0d5
LP		 5232 if (arg_kill_signal > 0) {
5233 /* Try to kill the init system on SIGINT or SIGTERM */
5234 sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, UINT32_TO_PTR(pid));
5235 sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, UINT32_TO_PTR(pid));
5236 } else {
5237 /* Immediately exit */
5238 sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
5239 sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
5240 }
023fb90b 5241
03cfe0d5
LP		 5242 /* simply exit on sigchld */
5243 sd_event_add_signal(event, NULL, SIGCHLD, NULL, NULL);
023fb90b 5244
03cfe0d5
LP		 5245 if (arg_expose_ports) {
5246 r = watch_rtnl(event, rtnl_socket_pair[0], &exposed, &rtnl);
5247 if (r < 0)
5248 goto finish;
023fb90b 5249
03cfe0d5
LP		 5250 (void) expose_ports(rtnl, &exposed);
5251 }
023fb90b 5252
03cfe0d5 5253 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
c7b7d449 5254
03cfe0d5
LP		 5255 r = pty_forward_new(event, master, true, !interactive, &forward);
5256 if (r < 0) {
5257 log_error_errno(r, "Failed to create PTY forwarder: %m");
5258 goto finish;
5259 }
023fb90b 5260
03cfe0d5
LP		 5261 r = sd_event_loop(event);
5262 if (r < 0) {
5263 log_error_errno(r, "Failed to run event loop: %m");
5264 goto finish;
5265 }
6d0b55c2 5266
03cfe0d5 5267 pty_forward_get_last_char(forward, &last_char);
6d0b55c2 5268
03cfe0d5 5269 forward = pty_forward_free(forward);
6d0b55c2 5270
03cfe0d5
LP		 5271 if (!arg_quiet && last_char != '\n')
5272 putc('\n', stdout);
04d39279 5273
03cfe0d5
LP		 5274 /* Kill if it is not dead yet anyway */
5275 terminate_machine(pid);
1f0cd86b 5276
840295fc 5277 /* Normally redundant, but better safe than sorry */
04d39279 5278 kill(pid, SIGKILL);
a258bf26 5279
113cea80 5280 r = wait_for_container(pid, &container_status);
04d39279
LP		 5281 pid = 0;
5282
ec16945e 5283 if (r < 0)
ce9f1527
LP		 5284 /* We failed to wait for the container, or the
5285 * container exited abnormally */
ec16945e
LP		 5286 goto finish;
5287 else if (r > 0 || container_status == CONTAINER_TERMINATED){
ce9f1527
LP		 5288 /* The container exited with a non-zero
5289 * status, or with zero status and no reboot
5290 * was requested. */
ec16945e 5291 ret = r;
d87be9b0 5292 break;
ec16945e 5293 }
88213476 5294
113cea80 5295 /* CONTAINER_REBOOTED, loop again */
ce38dbc8
LP		 5296
5297 if (arg_keep_unit) {
5298 /* Special handling if we are running as a
5299 * service: instead of simply restarting the
5300 * machine we want to restart the entire
5301 * service, so let's inform systemd about this
5302 * with the special exit code 133. The service
5303 * file uses RestartForceExitStatus=133 so
5304 * that this results in a full nspawn
5305 * restart. This is necessary since we might
5306 * have cgroup parameters set we want to have
5307 * flushed out. */
ec16945e
LP		 5308 ret = 133;
5309 r = 0;
ce38dbc8
LP		 5310 break;
5311 }
6d0b55c2
LP		 5312
5313 flush_ports(&exposed);
d87be9b0 5314 }
88213476
LP		 5315
5316finish:
af4ec430
LP		 5317 sd_notify(false,
5318 "STOPPING=1\n"
5319 "STATUS=Terminating...");
5320
9444b1f2
LP		 5321 if (pid > 0)
5322 kill(pid, SIGKILL);
88213476 5323
503546da
LP		 5324 /* Try to flush whatever is still queued in the pty */
5325 if (master >= 0)
5326 (void) copy_bytes(master, STDOUT_FILENO, (off_t) -1, false);
5327
03cfe0d5
LP		 5328 loop_remove(loop_nr, &image_fd);
5329
ec16945e
LP		 5330 if (remove_subvol && arg_directory) {
5331 int k;
5332
d9e2daaf 5333 k = btrfs_subvol_remove(arg_directory, true);
ec16945e
LP		 5334 if (k < 0)
5335 log_warning_errno(k, "Cannot remove subvolume '%s', ignoring: %m", arg_directory);
5336 }
5337
785890ac
LP		 5338 if (arg_machine) {
5339 const char *p;
5340
63c372cb 5341 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 5342 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 5343 }
5344
04d391da 5345 free(arg_directory);
ec16945e
LP		 5346 free(arg_template);
5347 free(arg_image);
7027ff61 5348 free(arg_machine);
c74e630d
LP		 5349 free(arg_user);
5350 strv_free(arg_setenv);
5351 strv_free(arg_network_interfaces);
5352 strv_free(arg_network_macvlan);
4bbfe7ad 5353 strv_free(arg_network_ipvlan);
5a8af538 5354 custom_mount_free_all();
88213476 5355
6d0b55c2
LP		 5356 flush_ports(&exposed);
5357
5358 while (arg_expose_ports) {
5359 ExposePort *p = arg_expose_ports;
5360 LIST_REMOVE(ports, arg_expose_ports, p);
5361 free(p);
5362 }
5363
ec16945e 5364 return r < 0 ? EXIT_FAILURE : ret;
88213476 5365}
Unnamed repository; edit this file 'description' to name the repository.