]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
dissect: drop partition removal code
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
88213476 2
349cc4a5 3#if HAVE_BLKID
8fe0087e 4#endif
88213476 5#include <errno.h>
88213476 6#include <getopt.h>
503f480f 7#include <linux/fs.h>
1b9e5b12 8#include <linux/loop.h>
349cc4a5 9#if HAVE_SELINUX
8fe0087e 10#include <selinux/selinux.h>
1b9e5b12 11#endif
8fe0087e 12#include <stdlib.h>
8fe0087e 13#include <sys/file.h>
335d2ead 14#include <sys/ioctl.h>
8fe0087e
LP		 15#include <sys/personality.h>
16#include <sys/prctl.h>
17#include <sys/types.h>
6916b164 18#include <sys/wait.h>
335d2ead 19#include <termios.h>
8fe0087e 20#include <unistd.h>
1b9e5b12 21
b053cd5f 22#include "sd-bus.h"
1f0cd86b 23#include "sd-daemon.h"
1f0cd86b 24#include "sd-id128.h"
8fe0087e 25
b5efdb8a 26#include "alloc-util.h"
8fe0087e
LP		 27#include "barrier.h"
28#include "base-filesystem.h"
29#include "blkid-util.h"
30#include "btrfs-util.h"
b8ea7a6e 31#include "bus-error.h"
b053cd5f 32#include "bus-util.h"
8fe0087e 33#include "cap-list.h"
430f0182 34#include "capability-util.h"
04d391da 35#include "cgroup-util.h"
f4351959 36#include "chase-symlinks.h"
8fe0087e 37#include "copy.h"
d107bb7d 38#include "cpu-set-util.h"
786d19fd 39#include "creds-util.h"
4fc9982c 40#include "dev-setup.h"
57f1b61b 41#include "discover-image.h"
2d845785 42#include "dissect-image.h"
8fe0087e 43#include "env-util.h"
3652872a 44#include "escape.h"
3ffd4af2 45#include "fd-util.h"
842f3b0f 46#include "fdset.h"
a5c32cff 47#include "fileio.h"
f97b34a6 48#include "format-util.h"
f4f15635 49#include "fs-util.h"
1b9e5b12 50#include "gpt.h"
4623e8e6 51#include "hexdecoct.h"
e2054217 52#include "hostname-setup.h"
8fe0087e 53#include "hostname-util.h"
910fd145 54#include "id128-util.h"
3652872a 55#include "io-util.h"
8fe0087e 56#include "log.h"
2d845785 57#include "loop-util.h"
8fe0087e 58#include "loopback-setup.h"
8fe0087e 59#include "macro.h"
44dbef90 60#include "main-func.h"
f5947a5e 61#include "missing_sched.h"
8fe0087e 62#include "mkdir.h"
4349cd7c 63#include "mount-util.h"
049af8ad 64#include "mountpoint-util.h"
0cb8e3d1 65#include "namespace-util.h"
8fe0087e 66#include "netlink-util.h"
2f893044 67#include "nspawn-bind-user.h"
07630cea 68#include "nspawn-cgroup.h"
3652872a 69#include "nspawn-creds.h"
3603efde 70#include "nspawn-def.h"
07630cea
LP		 71#include "nspawn-expose-ports.h"
72#include "nspawn-mount.h"
73#include "nspawn-network.h"
de40a303 74#include "nspawn-oci.h"
7336138e 75#include "nspawn-patch-uid.h"
07630cea 76#include "nspawn-register.h"
910fd145 77#include "nspawn-seccomp.h"
07630cea
LP		 78#include "nspawn-settings.h"
79#include "nspawn-setuid.h"
7732f92b 80#include "nspawn-stub-pid1.h"
c9394f4f 81#include "nspawn-util.h"
91181e07 82#include "nspawn.h"
d8b4d14d 83#include "nulstr-util.h"
d58ad743 84#include "os-util.h"
50ebcf6c 85#include "pager.h"
614b022c 86#include "parse-argument.h"
6bedfcbb 87#include "parse-util.h"
294bf0c3 88#include "pretty-print.h"
0b452006 89#include "process-util.h"
8fe0087e
LP		 90#include "ptyfwd.h"
91#include "random-util.h"
8869a0b4 92#include "raw-clone.h"
86775e35 93#include "resolve-util.h"
bf428efb 94#include "rlimit-util.h"
8fe0087e 95#include "rm-rf.h"
de40a303
LP		 96#if HAVE_SECCOMP
97#include "seccomp-util.h"
98#endif
68b02049 99#include "selinux-util.h"
8fe0087e 100#include "signal-util.h"
2583fbea 101#include "socket-util.h"
8fcde012 102#include "stat-util.h"
15a5e950 103#include "stdio-util.h"
5c828e66 104#include "string-table.h"
07630cea 105#include "string-util.h"
8fe0087e 106#include "strv.h"
de40a303 107#include "sysctl-util.h"
8fe0087e 108#include "terminal-util.h"
e4de7287 109#include "tmpfile-util.h"
affb60b1 110#include "umask-util.h"
43c3fb46 111#include "unit-name.h"
b1d4f8e1 112#include "user-util.h"
8fe0087e 113#include "util.h"
e9642be2 114
e96ceaba
LP		 115/* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
116#define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
0e7ac751 117
2a49b612
ZJS		 118#define EXIT_FORCE_RESTART 133
119
113cea80
DH		 120typedef enum ContainerStatus {
121 CONTAINER_TERMINATED,
6145bb4f 122 CONTAINER_REBOOTED,
113cea80
DH		 123} ContainerStatus;
124
88213476 125static char *arg_directory = NULL;
ec16945e 126static char *arg_template = NULL;
5f932eb9 127static char *arg_chdir = NULL;
b53ede69
PW		 128static char *arg_pivot_root_new = NULL;
129static char *arg_pivot_root_old = NULL;
687d0825 130static char *arg_user = NULL;
de40a303
LP		 131static uid_t arg_uid = UID_INVALID;
132static gid_t arg_gid = GID_INVALID;
133static gid_t* arg_supplementary_gids = NULL;
134static size_t arg_n_supplementary_gids = 0;
9444b1f2 135static sd_id128_t arg_uuid = {};
3a9530e5
LP		 136static char *arg_machine = NULL; /* The name used by the host to refer to this */
137static char *arg_hostname = NULL; /* The name the payload sees by default */
c74e630d
LP		 138static const char *arg_selinux_context = NULL;
139static const char *arg_selinux_apifs_context = NULL;
de40a303 140static char *arg_slice = NULL;
ff01d048 141static bool arg_private_network = false;
bc2f673e 142static bool arg_read_only = false;
7732f92b 143static StartMode arg_start_mode = START_PID1;
ec16945e 144static bool arg_ephemeral = false;
57fb9fb5 145static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 146static bool arg_link_journal_try = false;
520e0d54 147static uint64_t arg_caps_retain =
50b52222
LP		 148 (1ULL << CAP_AUDIT_CONTROL) |
149 (1ULL << CAP_AUDIT_WRITE) |
5076f0cc
LP		 150 (1ULL << CAP_CHOWN) |
151 (1ULL << CAP_DAC_OVERRIDE) |
152 (1ULL << CAP_DAC_READ_SEARCH) |
153 (1ULL << CAP_FOWNER) |
154 (1ULL << CAP_FSETID) |
155 (1ULL << CAP_IPC_OWNER) |
156 (1ULL << CAP_KILL) |
157 (1ULL << CAP_LEASE) |
158 (1ULL << CAP_LINUX_IMMUTABLE) |
50b52222 159 (1ULL << CAP_MKNOD) |
5076f0cc
LP		 160 (1ULL << CAP_NET_BIND_SERVICE) |
161 (1ULL << CAP_NET_BROADCAST) |
162 (1ULL << CAP_NET_RAW) |
5076f0cc 163 (1ULL << CAP_SETFCAP) |
50b52222 164 (1ULL << CAP_SETGID) |
5076f0cc
LP		 165 (1ULL << CAP_SETPCAP) |
166 (1ULL << CAP_SETUID) |
167 (1ULL << CAP_SYS_ADMIN) |
50b52222 168 (1ULL << CAP_SYS_BOOT) |
5076f0cc
LP		 169 (1ULL << CAP_SYS_CHROOT) |
170 (1ULL << CAP_SYS_NICE) |
171 (1ULL << CAP_SYS_PTRACE) |
d87be9b0 172 (1ULL << CAP_SYS_RESOURCE) |
50b52222 173 (1ULL << CAP_SYS_TTY_CONFIG);
88fc9c9b 174static uint64_t arg_caps_ambient = 0;
de40a303 175static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
5a8af538 176static CustomMount *arg_custom_mounts = NULL;
88614c8a 177static size_t arg_n_custom_mounts = 0;
f4889f65 178static char **arg_setenv = NULL;
284c0b91 179static bool arg_quiet = false;
eb91eb18 180static bool arg_register = true;
89f7c846 181static bool arg_keep_unit = false;
aa28aefe 182static char **arg_network_interfaces = NULL;
c74e630d 183static char **arg_network_macvlan = NULL;
4bbfe7ad 184static char **arg_network_ipvlan = NULL;
69c79d3c 185static bool arg_network_veth = false;
f6d6bad1 186static char **arg_network_veth_extra = NULL;
f757855e 187static char *arg_network_bridge = NULL;
22b28dfd 188static char *arg_network_zone = NULL;
d7bea6b6 189static char *arg_network_namespace_path = NULL;
bb068de0 190static PagerFlags arg_pager_flags = 0;
050f7277 191static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 192static char *arg_image = NULL;
de40a303 193static char *arg_oci_bundle = NULL;
f757855e 194static VolatileMode arg_volatile_mode = VOLATILE_NO;
6d0b55c2 195static ExposePort *arg_expose_ports = NULL;
f36933fe 196static char **arg_property = NULL;
de40a303 197static sd_bus_message *arg_property_message = NULL;
0de7acce 198static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
6dac160c 199static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
6c045a99 200static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
c6c8f6e2 201static int arg_kill_signal = 0;
5da38d07 202static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
f757855e
LP		 203static SettingsMask arg_settings_mask = 0;
204static int arg_settings_trusted = -1;
205static char **arg_parameters = NULL;
6aadfa4c 206static const char *arg_container_service_name = "systemd-nspawn";
9c1e04d0 207static bool arg_notify_ready = false;
5a8ff0e6 208static bool arg_use_cgns = true;
0c582db0 209static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
1099ceeb 210static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
aee36b4e 211static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
6b000af4
LP		 212static char **arg_syscall_allow_list = NULL;
213static char **arg_syscall_deny_list = NULL;
de40a303
LP		 214#if HAVE_SECCOMP
215static scmp_filter_ctx arg_seccomp = NULL;
216#endif
bf428efb 217static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
66edd963 218static bool arg_no_new_privileges = false;
81f345df
LP		 219static int arg_oom_score_adjust = 0;
220static bool arg_oom_score_adjust_set = false;
0985c7c4 221static CPUSet arg_cpu_set = {};
09d423e9 222static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
1688841f 223static TimezoneMode arg_timezone = TIMEZONE_AUTO;
f5fbe71d 224static unsigned arg_console_width = UINT_MAX, arg_console_height = UINT_MAX;
de40a303
LP		 225static DeviceNode* arg_extra_nodes = NULL;
226static size_t arg_n_extra_nodes = 0;
227static char **arg_sysctl = NULL;
228static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
3652872a
LP		 229static Credential *arg_credentials = NULL;
230static size_t arg_n_credentials = 0;
2f893044 231static char **arg_bind_user = NULL;
4a4654e0 232static bool arg_suppress_sync = false;
3603f151 233static char *arg_settings_filename = NULL;
88213476 234
6145bb4f
LP		 235STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
236STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
237STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
238STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
239STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
240STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
241STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
242STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
243STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
244STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
245STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
246STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
247STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
248STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
249STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
250STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
251STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
252STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
253STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
254STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
255STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
256STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
257STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
89e62e0b 258STATIC_DESTRUCTOR_REGISTER(arg_verity_settings, verity_settings_done);
6b000af4
LP		 259STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
260STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
6145bb4f
LP		 261#if HAVE_SECCOMP
262STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
263#endif
0985c7c4 264STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
6145bb4f 265STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
2f893044 266STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
3603f151 267STATIC_DESTRUCTOR_REGISTER(arg_settings_filename, freep);
6145bb4f 268
dce66ffe
ZJS		 269static int handle_arg_console(const char *arg) {
270 if (streq(arg, "help")) {
10e8a60b
LP		 271 puts("autopipe\n"
272 "interactive\n"
dce66ffe 273 "passive\n"
10e8a60b
LP		 274 "pipe\n"
275 "read-only");
dce66ffe
ZJS		 276 return 0;
277 }
278
279 if (streq(arg, "interactive"))
280 arg_console_mode = CONSOLE_INTERACTIVE;
281 else if (streq(arg, "read-only"))
282 arg_console_mode = CONSOLE_READ_ONLY;
283 else if (streq(arg, "passive"))
284 arg_console_mode = CONSOLE_PASSIVE;
554c4beb
LP		 285 else if (streq(arg, "pipe")) {
286 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
287 log_full(arg_quiet ? LOG_DEBUG : LOG_NOTICE,
288 "Console mode 'pipe' selected, but standard input/output are connected to an interactive TTY. "
289 "Most likely you want to use 'interactive' console mode for proper interactivity and shell job control. "
290 "Proceeding anyway.");
291
dce66ffe 292 arg_console_mode = CONSOLE_PIPE;
10e8a60b
LP		 293 } else if (streq(arg, "autopipe")) {
294 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
295 arg_console_mode = CONSOLE_INTERACTIVE;
296 else
297 arg_console_mode = CONSOLE_PIPE;
554c4beb 298 } else
dce66ffe
ZJS		 299 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
300
301 arg_settings_mask |= SETTING_CONSOLE_MODE;
302 return 1;
303}
304
37ec0fdd
LP		 305static int help(void) {
306 _cleanup_free_ char *link = NULL;
307 int r;
308
384c2c32 309 pager_open(arg_pager_flags);
50ebcf6c 310
37ec0fdd
LP		 311 r = terminal_urlify_man("systemd-nspawn", "1", &link);
312 if (r < 0)
313 return log_oom();
314
25148653 315 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
37a92352 316 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
a8828ed9
DW		 317 " -h --help Show this help\n"
318 " --version Print version string\n"
69c79d3c 319 " -q --quiet Do not show status information\n"
bb068de0 320 " --no-pager Do not pipe output into a pager\n"
25148653
LP		 321 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
322 "%3$sImage:%4$s\n"
1b9e5b12 323 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 324 " --template=PATH Initialize root directory from template directory,\n"
325 " if missing\n"
326 " -x --ephemeral Run container with snapshot of root directory, and\n"
327 " remove it after exit\n"
25e68fd3
LP		 328 " -i --image=PATH Root file system disk image (or device node) for\n"
329 " the container\n"
de40a303 330 " --oci-bundle=PATH OCI bundle directory\n"
25148653
LP		 331 " --read-only Mount the root directory read-only\n"
332 " --volatile[=MODE] Run the system in volatile mode\n"
25e68fd3 333 " --root-hash=HASH Specify verity root hash for root disk image\n"
c2923fdc
LB		 334 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
335 " as a DER encoded PKCS7, either as a path to a file\n"
336 " or as an ASCII base64 encoded string prefixed by\n"
337 " 'base64:'\n"
e7cbe5cb 338 " --verity-data=PATH Specify hash device for verity\n"
25148653
LP		 339 " --pivot-root=PATH[:PATH]\n"
340 " Pivot root to given directory in the container\n\n"
341 "%3$sExecution:%4$s\n"
7732f92b 342 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
a8828ed9 343 " -b --boot Boot up full system (i.e. invoke init)\n"
5f932eb9 344 " --chdir=PATH Set working directory in the container\n"
0d2a0179 345 " -E --setenv=NAME[=VALUE] Pass an environment variable to PID 1\n"
25148653
LP		 346 " -u --user=USER Run the command under specified user or UID\n"
347 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
4a4654e0
LP		 348 " --notify-ready=BOOLEAN Receive notifications from the child init process\n"
349 " --suppress-sync=BOOLEAN\n"
350 " Suppress any form of disk data synchronization\n\n"
25148653 351 "%3$sSystem Identity:%4$s\n"
a8828ed9 352 " -M --machine=NAME Set the machine name for the container\n"
3a9530e5 353 " --hostname=NAME Override the hostname for the container\n"
25148653
LP		 354 " --uuid=UUID Set a specific machine UUID for the container\n\n"
355 "%3$sProperties:%4$s\n"
a8828ed9 356 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 357 " --property=NAME=VALUE Set scope unit property\n"
25148653
LP		 358 " --register=BOOLEAN Register container as machine\n"
359 " --keep-unit Do not register a scope for the machine, reuse\n"
360 " the service unit nspawn is running in\n\n"
361 "%3$sUser Namespacing:%4$s\n"
b917743d
YW		 362 " --private-users=no Run without user namespacing\n"
363 " --private-users=yes|pick|identity\n"
364 " Run within user namespace, autoselect UID/GID range\n"
365 " --private-users=UIDBASE[:NUIDS]\n"
90b4a64d 366 " Similar, but with user configured UID/GID range\n"
6c045a99
LP		 367 " --private-users-ownership=MODE\n"
368 " Adjust ('chown') or map ('map') OS tree ownership\n"
b917743d
YW		 369 " to private UID/GID range\n"
370 " -U Equivalent to --private-users=pick and\n"
371 " --private-users-ownership=auto\n\n"
25148653 372 "%3$sNetworking:%4$s\n"
69c79d3c
LP		 373 " --private-network Disable network in container\n"
374 " --network-interface=INTERFACE\n"
375 " Assign an existing network interface to the\n"
376 " container\n"
c74e630d
LP		 377 " --network-macvlan=INTERFACE\n"
378 " Create a macvlan network interface based on an\n"
379 " existing network interface to the container\n"
4bbfe7ad 380 " --network-ipvlan=INTERFACE\n"
387f6955 381 " Create an ipvlan network interface based on an\n"
4bbfe7ad 382 " existing network interface to the container\n"
a8eaaee7 383 " -n --network-veth Add a virtual Ethernet connection between host\n"
69c79d3c 384 " and container\n"
f6d6bad1
LP		 385 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
386 " Add an additional virtual Ethernet link between\n"
387 " host and container\n"
ab046dde 388 " --network-bridge=INTERFACE\n"
90b4a64d
ZJS		 389 " Add a virtual Ethernet connection to the container\n"
390 " and attach it to an existing bridge on the host\n"
391 " --network-zone=NAME Similar, but attach the new interface to an\n"
392 " an automatically managed bridge interface\n"
d7bea6b6
DP		 393 " --network-namespace-path=PATH\n"
394 " Set network namespace to the one represented by\n"
395 " the specified kernel namespace file node\n"
6d0b55c2 396 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
25148653
LP		 397 " Expose a container IP port on the host\n\n"
398 "%3$sSecurity:%4$s\n"
a8828ed9
DW		 399 " --capability=CAP In addition to the default, retain specified\n"
400 " capability\n"
401 " --drop-capability=CAP Drop the specified capability from the default set\n"
88fc9c9b
TH		 402 " --ambient-capability=CAP\n"
403 " Sets the specified capability for the started\n"
404 " process. Not useful if booting a machine.\n"
f4e803c8 405 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
960e4569
LP		 406 " --system-call-filter=LIST|~LIST\n"
407 " Permit/prohibit specific system calls\n"
25148653
LP		 408 " -Z --selinux-context=SECLABEL\n"
409 " Set the SELinux security context to be used by\n"
410 " processes in the container\n"
411 " -L --selinux-apifs-context=SECLABEL\n"
412 " Set the SELinux security context to be used by\n"
413 " API/tmpfs file systems in the container\n\n"
414 "%3$sResources:%4$s\n"
bf428efb 415 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
81f345df
LP		 416 " --oom-score-adjust=VALUE\n"
417 " Adjust the OOM score value for the payload\n"
f4e803c8
LP		 418 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
419 " --personality=ARCH Pick personality for this container\n\n"
25148653 420 "%3$sIntegration:%4$s\n"
09d423e9 421 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
1688841f 422 " --timezone=MODE Select mode of /etc/localtime initialization\n"
25148653
LP		 423 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
424 " host, try-guest, try-host\n"
425 " -j Equivalent to --link-journal=try-guest\n\n"
426 "%3$sMounts:%4$s\n"
5e5bfa6e
EY		 427 " --bind=PATH[:PATH[:OPTIONS]]\n"
428 " Bind mount a file or directory from the host into\n"
a8828ed9 429 " the container\n"
5e5bfa6e
EY		 430 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
431 " Similar, but creates a read-only bind mount\n"
de40a303
LP		 432 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
433 " it\n"
06c17c39 434 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 435 " --overlay=PATH[:PATH...]:PATH\n"
436 " Create an overlay mount from the host to \n"
437 " the container\n"
438 " --overlay-ro=PATH[:PATH...]:PATH\n"
2f893044
LP		 439 " Similar, but creates a read-only overlay mount\n"
440 " --bind-user=NAME Bind user from host to container\n\n"
25148653 441 "%3$sInput/Output:%4$s\n"
de40a303
LP		 442 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
443 " set up for the container.\n"
3652872a
LP		 444 " -P --pipe Equivalent to --console=pipe\n\n"
445 "%3$sCredentials:%4$s\n"
446 " --set-credential=ID:VALUE\n"
447 " Pass a credential with literal value to container.\n"
448 " --load-credential=ID:PATH\n"
449 " Load credential to pass to container from file or\n"
450 " AF_UNIX stream socket.\n"
bc556335
DDM		 451 "\nSee the %2$s for details.\n",
452 program_invocation_short_name,
453 link,
454 ansi_underline(),
455 ansi_normal(),
456 ansi_highlight(),
457 ansi_normal());
37ec0fdd
LP		 458
459 return 0;
88213476
LP		 460}
461
86c0dd4a 462static int custom_mount_check_all(void) {
88614c8a 463 size_t i;
5a8af538 464
5a8af538
LP		 465 for (i = 0; i < arg_n_custom_mounts; i++) {
466 CustomMount *m = &arg_custom_mounts[i];
467
0de7acce 468 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
6c045a99 469 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_OFF)
baaa35ad 470 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
c920b863 471 "--private-users-ownership=own may not be combined with custom root mounts.");
6c045a99 472 if (arg_uid_shift == UID_INVALID)
baaa35ad
ZJS		 473 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
474 "--private-users with automatic UID shift may not be combined with custom root mounts.");
825d5287 475 }
5a8af538
LP		 476 }
477
478 return 0;
479}
480
8199d554 481static int detect_unified_cgroup_hierarchy_from_environment(void) {
c78c095b 482 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
415fc41c 483 int r;
5da38d07 484
efdb0237 485 /* Allow the user to control whether the unified hierarchy is used */
c78c095b
ZJS		 486
487 e = getenv(var);
488 if (!e) {
d5fc5b2f 489 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
c78c095b
ZJS		 490 var = "UNIFIED_CGROUP_HIERARCHY";
491 e = getenv(var);
c78c095b
ZJS		 492 }
493
494 if (!isempty(e)) {
efdb0237
LP		 495 r = parse_boolean(e);
496 if (r < 0)
c78c095b 497 return log_error_errno(r, "Failed to parse $%s: %m", var);
5da38d07
TH		 498 if (r > 0)
499 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
500 else
501 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237
LP		 502 }
503
8199d554
LP		 504 return 0;
505}
506
507static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
508 int r;
509
75b0d8b8
ZJS		 510 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
511 * in the image actually supports. */
b4cccbc1
LP		 512 r = cg_all_unified();
513 if (r < 0)
514 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
515 if (r > 0) {
a8725a06
ZJS		 516 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
517 * routine only detects 231, so we'll have a false negative here for 230. */
7e6821ed 518 r = systemd_installation_has_version(directory, "230");
a8725a06
ZJS		 519 if (r < 0)
520 return log_error_errno(r, "Failed to determine systemd version in container: %m");
521 if (r > 0)
522 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
523 else
524 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
c22800e4 525 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2977724b 526 /* Mixed cgroup hierarchy support was added in 233 */
7e6821ed 527 r = systemd_installation_has_version(directory, "233");
0fd9563f
ZJS		 528 if (r < 0)
529 return log_error_errno(r, "Failed to determine systemd version in container: %m");
530 if (r > 0)
531 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
532 else
533 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
534 } else
5da38d07 535 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 536
8199d554
LP		 537 log_debug("Using %s hierarchy for container.",
538 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
539 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
540
efdb0237
LP		 541 return 0;
542}
543
8a99bd0c
ZJS		 544static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
545 uint64_t mask = 0;
546 int r;
547
548 for (;;) {
549 _cleanup_free_ char *t = NULL;
550
551 r = extract_first_word(&spec, &t, ",", 0);
552 if (r < 0)
553 return log_error_errno(r, "Failed to parse capability %s.", t);
554 if (r == 0)
555 break;
556
557 if (streq(t, "help")) {
558 for (int i = 0; i < capability_list_length(); i++) {
559 const char *name;
560
561 name = capability_to_name(i);
562 if (name)
563 puts(name);
564 }
565
566 return 0; /* quit */
567 }
568
569 if (streq(t, "all"))
f5fbe71d 570 mask = UINT64_MAX;
8a99bd0c
ZJS		 571 else {
572 r = capability_from_name(t);
573 if (r < 0)
574 return log_error_errno(r, "Failed to parse capability %s.", t);
575
576 mask |= 1ULL << r;
577 }
578 }
579
580 *ret_mask = mask;
581 return 1; /* continue */
582}
583
49048684 584static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
0c582db0
LB		 585 int r;
586
587 r = getenv_bool(name);
588 if (r == -ENXIO)
49048684 589 return 0;
0c582db0 590 if (r < 0)
49048684 591 return log_error_errno(r, "Failed to parse $%s: %m", name);
de40a303 592
0c582db0 593 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
de40a303 594 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
49048684 595 return 0;
0c582db0
LB		 596}
597
49048684 598static int parse_mount_settings_env(void) {
4f086aab 599 const char *e;
1099ceeb
LP		 600 int r;
601
602 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
49048684
ZJS		 603 if (r < 0 && r != -ENXIO)
604 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
1099ceeb
LP		 605 if (r >= 0)
606 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
4f086aab
SU		 607
608 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
49048684 609 if (streq_ptr(e, "network"))
4f086aab 610 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
4f086aab 611
49048684
ZJS		 612 else if (e) {
613 r = parse_boolean(e);
614 if (r < 0)
615 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
616
617 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
618 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
ab8ee0f2 619 }
4f086aab 620
49048684 621 return 0;
4f086aab
SU		 622}
623
49048684 624static int parse_environment(void) {
d5455d2f
LP		 625 const char *e;
626 int r;
627
49048684
ZJS		 628 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
629 if (r < 0)
630 return r;
631 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
632 if (r < 0)
633 return r;
634 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
635 if (r < 0)
636 return r;
637 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
638 if (r < 0)
639 return r;
d5455d2f 640
49048684
ZJS		 641 r = parse_mount_settings_env();
642 if (r < 0)
643 return r;
d5455d2f 644
489fae52
ZJS		 645 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
646 * even if it is supported. If not supported, it has no effect. */
de40a303 647 if (!cg_ns_supported())
489fae52 648 arg_use_cgns = false;
de40a303
LP		 649 else {
650 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
651 if (r < 0) {
652 if (r != -ENXIO)
49048684 653 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
de40a303
LP		 654
655 arg_use_cgns = true;
656 } else {
657 arg_use_cgns = r > 0;
658 arg_settings_mask |= SETTING_USE_CGNS;
659 }
660 }
d5455d2f
LP		 661
662 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
663 if (e)
664 arg_container_service_name = e;
665
4a4654e0
LP		 666 r = getenv_bool("SYSTEMD_SUPPRESS_SYNC");
667 if (r >= 0)
668 arg_suppress_sync = r;
669 else if (r != -ENXIO)
670 log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
671
49048684 672 return detect_unified_cgroup_hierarchy_from_environment();
d5455d2f
LP		 673}
674
88213476 675static int parse_argv(int argc, char *argv[]) {
a41fe3a2 676 enum {
acbeb427
ZJS		 677 ARG_VERSION = 0x100,
678 ARG_PRIVATE_NETWORK,
bc2f673e 679 ARG_UUID,
5076f0cc 680 ARG_READ_ONLY,
57fb9fb5 681 ARG_CAPABILITY,
88fc9c9b 682 ARG_AMBIENT_CAPABILITY,
420c7379 683 ARG_DROP_CAPABILITY,
17fe0523
LP		 684 ARG_LINK_JOURNAL,
685 ARG_BIND,
f4889f65 686 ARG_BIND_RO,
06c17c39 687 ARG_TMPFS,
5a8af538
LP		 688 ARG_OVERLAY,
689 ARG_OVERLAY_RO,
de40a303 690 ARG_INACCESSIBLE,
eb91eb18 691 ARG_SHARE_SYSTEM,
89f7c846 692 ARG_REGISTER,
aa28aefe 693 ARG_KEEP_UNIT,
69c79d3c 694 ARG_NETWORK_INTERFACE,
c74e630d 695 ARG_NETWORK_MACVLAN,
4bbfe7ad 696 ARG_NETWORK_IPVLAN,
ab046dde 697 ARG_NETWORK_BRIDGE,
22b28dfd 698 ARG_NETWORK_ZONE,
f6d6bad1 699 ARG_NETWORK_VETH_EXTRA,
d7bea6b6 700 ARG_NETWORK_NAMESPACE_PATH,
6afc95b7 701 ARG_PERSONALITY,
4d9f07b4 702 ARG_VOLATILE,
ec16945e 703 ARG_TEMPLATE,
f36933fe 704 ARG_PROPERTY,
6dac160c 705 ARG_PRIVATE_USERS,
c6c8f6e2 706 ARG_KILL_SIGNAL,
f757855e 707 ARG_SETTINGS,
5f932eb9 708 ARG_CHDIR,
b53ede69 709 ARG_PIVOT_ROOT,
7336138e 710 ARG_PRIVATE_USERS_CHOWN,
6c045a99 711 ARG_PRIVATE_USERS_OWNERSHIP,
9c1e04d0 712 ARG_NOTIFY_READY,
4623e8e6 713 ARG_ROOT_HASH,
89e62e0b
LP		 714 ARG_ROOT_HASH_SIG,
715 ARG_VERITY_DATA,
960e4569 716 ARG_SYSTEM_CALL_FILTER,
bf428efb 717 ARG_RLIMIT,
3a9530e5 718 ARG_HOSTNAME,
66edd963 719 ARG_NO_NEW_PRIVILEGES,
81f345df 720 ARG_OOM_SCORE_ADJUST,
d107bb7d 721 ARG_CPU_AFFINITY,
09d423e9 722 ARG_RESOLV_CONF,
1688841f 723 ARG_TIMEZONE,
de40a303
LP		 724 ARG_CONSOLE,
725 ARG_PIPE,
726 ARG_OCI_BUNDLE,
bb068de0 727 ARG_NO_PAGER,
3652872a
LP		 728 ARG_SET_CREDENTIAL,
729 ARG_LOAD_CREDENTIAL,
2f893044 730 ARG_BIND_USER,
4a4654e0 731 ARG_SUPPRESS_SYNC,
a41fe3a2
LP		 732 };
733
88213476 734 static const struct option options[] = {
d7bea6b6
DP		 735 { "help", no_argument, NULL, 'h' },
736 { "version", no_argument, NULL, ARG_VERSION },
737 { "directory", required_argument, NULL, 'D' },
738 { "template", required_argument, NULL, ARG_TEMPLATE },
739 { "ephemeral", no_argument, NULL, 'x' },
740 { "user", required_argument, NULL, 'u' },
741 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
742 { "as-pid2", no_argument, NULL, 'a' },
743 { "boot", no_argument, NULL, 'b' },
744 { "uuid", required_argument, NULL, ARG_UUID },
745 { "read-only", no_argument, NULL, ARG_READ_ONLY },
746 { "capability", required_argument, NULL, ARG_CAPABILITY },
88fc9c9b 747 { "ambient-capability", required_argument, NULL, ARG_AMBIENT_CAPABILITY },
d7bea6b6 748 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
66edd963 749 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
d7bea6b6
DP		 750 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
751 { "bind", required_argument, NULL, ARG_BIND },
752 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
753 { "tmpfs", required_argument, NULL, ARG_TMPFS },
754 { "overlay", required_argument, NULL, ARG_OVERLAY },
755 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
de40a303 756 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
d7bea6b6 757 { "machine", required_argument, NULL, 'M' },
3a9530e5 758 { "hostname", required_argument, NULL, ARG_HOSTNAME },
d7bea6b6
DP		 759 { "slice", required_argument, NULL, 'S' },
760 { "setenv", required_argument, NULL, 'E' },
761 { "selinux-context", required_argument, NULL, 'Z' },
762 { "selinux-apifs-context", required_argument, NULL, 'L' },
763 { "quiet", no_argument, NULL, 'q' },
764 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
765 { "register", required_argument, NULL, ARG_REGISTER },
766 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
767 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
768 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
769 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
770 { "network-veth", no_argument, NULL, 'n' },
771 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
772 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
773 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
774 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
775 { "personality", required_argument, NULL, ARG_PERSONALITY },
776 { "image", required_argument, NULL, 'i' },
777 { "volatile", optional_argument, NULL, ARG_VOLATILE },
778 { "port", required_argument, NULL, 'p' },
779 { "property", required_argument, NULL, ARG_PROPERTY },
780 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
6c045a99
LP		 781 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN }, /* obsolete */
782 { "private-users-ownership",required_argument, NULL, ARG_PRIVATE_USERS_OWNERSHIP},
d7bea6b6
DP		 783 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
784 { "settings", required_argument, NULL, ARG_SETTINGS },
785 { "chdir", required_argument, NULL, ARG_CHDIR },
786 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
787 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
788 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
89e62e0b
LP		 789 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
790 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
d7bea6b6 791 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
bf428efb 792 { "rlimit", required_argument, NULL, ARG_RLIMIT },
81f345df 793 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
d107bb7d 794 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
09d423e9 795 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
1688841f 796 { "timezone", required_argument, NULL, ARG_TIMEZONE },
de40a303
LP		 797 { "console", required_argument, NULL, ARG_CONSOLE },
798 { "pipe", no_argument, NULL, ARG_PIPE },
799 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
bb068de0 800 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
3652872a
LP		 801 { "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
802 { "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
2f893044 803 { "bind-user", required_argument, NULL, ARG_BIND_USER },
4a4654e0 804 { "suppress-sync", required_argument, NULL, ARG_SUPPRESS_SYNC },
eb9da376 805 {}
88213476
LP		 806 };
807
9444b1f2 808 int c, r;
a42c8b54 809 uint64_t plus = 0, minus = 0;
f757855e 810 bool mask_all_settings = false, mask_no_settings = false;
88213476
LP		 811
812 assert(argc >= 0);
813 assert(argv);
814
de40a303 815 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
88213476
LP		 816 switch (c) {
817
818 case 'h':
37ec0fdd 819 return help();
88213476 820
acbeb427 821 case ARG_VERSION:
3f6fd1ba 822 return version();
acbeb427 823
88213476 824 case 'D':
614b022c 825 r = parse_path_argument(optarg, false, &arg_directory);
ec16945e 826 if (r < 0)
0f03c2a4 827 return r;
de40a303
LP		 828
829 arg_settings_mask |= SETTING_DIRECTORY;
ec16945e
LP		 830 break;
831
832 case ARG_TEMPLATE:
614b022c 833 r = parse_path_argument(optarg, false, &arg_template);
ec16945e 834 if (r < 0)
0f03c2a4 835 return r;
de40a303
LP		 836
837 arg_settings_mask |= SETTING_DIRECTORY;
88213476
LP		 838 break;
839
1b9e5b12 840 case 'i':
614b022c 841 r = parse_path_argument(optarg, false, &arg_image);
ec16945e 842 if (r < 0)
0f03c2a4 843 return r;
de40a303
LP		 844
845 arg_settings_mask |= SETTING_DIRECTORY;
846 break;
847
848 case ARG_OCI_BUNDLE:
614b022c 849 r = parse_path_argument(optarg, false, &arg_oci_bundle);
de40a303
LP		 850 if (r < 0)
851 return r;
852
ec16945e
LP		 853 break;
854
855 case 'x':
856 arg_ephemeral = true;
a2f577fc 857 arg_settings_mask |= SETTING_EPHEMERAL;
1b9e5b12
LP		 858 break;
859
687d0825 860 case 'u':
2fc09a9c
DM		 861 r = free_and_strdup(&arg_user, optarg);
862 if (r < 0)
7027ff61 863 return log_oom();
687d0825 864
f757855e 865 arg_settings_mask |= SETTING_USER;
687d0825
MV		 866 break;
867
22b28dfd
LP		 868 case ARG_NETWORK_ZONE: {
869 char *j;
870
b910cc72 871 j = strjoin("vz-", optarg);
22b28dfd
LP		 872 if (!j)
873 return log_oom();
874
875 if (!ifname_valid(j)) {
876 log_error("Network zone name not valid: %s", j);
877 free(j);
878 return -EINVAL;
879 }
880
df1fac6d 881 free_and_replace(arg_network_zone, j);
22b28dfd
LP		 882
883 arg_network_veth = true;
884 arg_private_network = true;
885 arg_settings_mask |= SETTING_NETWORK;
886 break;
887 }
888
ab046dde 889 case ARG_NETWORK_BRIDGE:
ef76dff2 890
baaa35ad
ZJS		 891 if (!ifname_valid(optarg))
892 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
893 "Bridge interface name not valid: %s", optarg);
ef76dff2 894
f757855e
LP		 895 r = free_and_strdup(&arg_network_bridge, optarg);
896 if (r < 0)
897 return log_oom();
ab046dde 898
4831981d 899 _fallthrough_;
0dfaa006 900 case 'n':
69c79d3c
LP		 901 arg_network_veth = true;
902 arg_private_network = true;
f757855e 903 arg_settings_mask |= SETTING_NETWORK;
69c79d3c
LP		 904 break;
905
f6d6bad1
LP		 906 case ARG_NETWORK_VETH_EXTRA:
907 r = veth_extra_parse(&arg_network_veth_extra, optarg);
908 if (r < 0)
909 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
910
911 arg_private_network = true;
912 arg_settings_mask |= SETTING_NETWORK;
913 break;
914
aa28aefe 915 case ARG_NETWORK_INTERFACE:
baaa35ad
ZJS		 916 if (!ifname_valid(optarg))
917 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
918 "Network interface name not valid: %s", optarg);
ef76dff2 919
b390f178
DDM		 920 r = test_network_interface_initialized(optarg);
921 if (r < 0)
922 return r;
923
c74e630d
LP		 924 if (strv_extend(&arg_network_interfaces, optarg) < 0)
925 return log_oom();
926
927 arg_private_network = true;
f757855e 928 arg_settings_mask |= SETTING_NETWORK;
c74e630d
LP		 929 break;
930
931 case ARG_NETWORK_MACVLAN:
ef76dff2 932
baaa35ad
ZJS		 933 if (!ifname_valid(optarg))
934 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
935 "MACVLAN network interface name not valid: %s", optarg);
ef76dff2 936
b390f178
DDM		 937 r = test_network_interface_initialized(optarg);
938 if (r < 0)
939 return r;
940
c74e630d 941 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 942 return log_oom();
943
4bbfe7ad 944 arg_private_network = true;
f757855e 945 arg_settings_mask |= SETTING_NETWORK;
4bbfe7ad
TG		 946 break;
947
948 case ARG_NETWORK_IPVLAN:
ef76dff2 949
baaa35ad
ZJS		 950 if (!ifname_valid(optarg))
951 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
952 "IPVLAN network interface name not valid: %s", optarg);
ef76dff2 953
b390f178
DDM		 954 r = test_network_interface_initialized(optarg);
955 if (r < 0)
956 return r;
957
4bbfe7ad
TG		 958 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
959 return log_oom();
960
4831981d 961 _fallthrough_;
ff01d048
LP		 962 case ARG_PRIVATE_NETWORK:
963 arg_private_network = true;
f757855e 964 arg_settings_mask |= SETTING_NETWORK;
a41fe3a2
LP		 965 break;
966
d7bea6b6 967 case ARG_NETWORK_NAMESPACE_PATH:
614b022c 968 r = parse_path_argument(optarg, false, &arg_network_namespace_path);
d7bea6b6
DP		 969 if (r < 0)
970 return r;
971
de40a303 972 arg_settings_mask |= SETTING_NETWORK;
d7bea6b6
DP		 973 break;
974
0f0dbc46 975 case 'b':
baaa35ad
ZJS		 976 if (arg_start_mode == START_PID2)
977 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
978 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 979
980 arg_start_mode = START_BOOT;
981 arg_settings_mask |= SETTING_START_MODE;
982 break;
983
984 case 'a':
baaa35ad
ZJS		 985 if (arg_start_mode == START_BOOT)
986 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
987 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 988
989 arg_start_mode = START_PID2;
990 arg_settings_mask |= SETTING_START_MODE;
0f0dbc46
LP		 991 break;
992
144f0fc0 993 case ARG_UUID:
9444b1f2 994 r = sd_id128_from_string(optarg, &arg_uuid);
317feb4d
LP		 995 if (r < 0)
996 return log_error_errno(r, "Invalid UUID: %s", optarg);
997
baaa35ad
ZJS		 998 if (sd_id128_is_null(arg_uuid))
999 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1000 "Machine UUID may not be all zeroes.");
f757855e
LP		 1001
1002 arg_settings_mask |= SETTING_MACHINE_ID;
9444b1f2 1003 break;
aa96c6cb 1004
43c3fb46
LP		 1005 case 'S': {
1006 _cleanup_free_ char *mangled = NULL;
1007
1008 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
de40a303
LP		 1009 if (r < 0)
1010 return log_oom();
1011
43c3fb46 1012 free_and_replace(arg_slice, mangled);
de40a303 1013 arg_settings_mask |= SETTING_SLICE;
144f0fc0 1014 break;
43c3fb46 1015 }
144f0fc0 1016
7027ff61 1017 case 'M':
c1521918 1018 if (isempty(optarg))
97b11eed 1019 arg_machine = mfree(arg_machine);
c1521918 1020 else {
52ef5dd7 1021 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1022 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1023 "Invalid machine name: %s", optarg);
7027ff61 1024
0c3c4284
LP		 1025 r = free_and_strdup(&arg_machine, optarg);
1026 if (r < 0)
eb91eb18 1027 return log_oom();
eb91eb18 1028 }
9ce6d1b3 1029 break;
7027ff61 1030
3a9530e5
LP		 1031 case ARG_HOSTNAME:
1032 if (isempty(optarg))
1033 arg_hostname = mfree(arg_hostname);
1034 else {
52ef5dd7 1035 if (!hostname_is_valid(optarg, 0))
baaa35ad
ZJS		 1036 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1037 "Invalid hostname: %s", optarg);
3a9530e5
LP		 1038
1039 r = free_and_strdup(&arg_hostname, optarg);
1040 if (r < 0)
1041 return log_oom();
1042 }
1043
1044 arg_settings_mask |= SETTING_HOSTNAME;
1045 break;
1046
82adf6af
LP		 1047 case 'Z':
1048 arg_selinux_context = optarg;
a8828ed9
DW		 1049 break;
1050
82adf6af
LP		 1051 case 'L':
1052 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 1053 break;
1054
bc2f673e
LP		 1055 case ARG_READ_ONLY:
1056 arg_read_only = true;
f757855e 1057 arg_settings_mask |= SETTING_READ_ONLY;
bc2f673e
LP		 1058 break;
1059
88fc9c9b
TH		 1060 case ARG_AMBIENT_CAPABILITY: {
1061 uint64_t m;
1062 r = parse_capability_spec(optarg, &m);
1063 if (r <= 0)
1064 return r;
1065 arg_caps_ambient |= m;
1066 arg_settings_mask |= SETTING_CAPABILITY;
1067 break;
1068 }
420c7379
LP		 1069 case ARG_CAPABILITY:
1070 case ARG_DROP_CAPABILITY: {
8a99bd0c
ZJS		 1071 uint64_t m;
1072 r = parse_capability_spec(optarg, &m);
1073 if (r <= 0)
1074 return r;
5076f0cc 1075
8a99bd0c
ZJS		 1076 if (c == ARG_CAPABILITY)
1077 plus |= m;
1078 else
1079 minus |= m;
f757855e 1080 arg_settings_mask |= SETTING_CAPABILITY;
5076f0cc
LP		 1081 break;
1082 }
66edd963
LP		 1083 case ARG_NO_NEW_PRIVILEGES:
1084 r = parse_boolean(optarg);
1085 if (r < 0)
1086 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1087
1088 arg_no_new_privileges = r;
1089 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1090 break;
1091
57fb9fb5
LP		 1092 case 'j':
1093 arg_link_journal = LINK_GUEST;
574edc90 1094 arg_link_journal_try = true;
4e1d6aa9 1095 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1096 break;
1097
1098 case ARG_LINK_JOURNAL:
4e1d6aa9 1099 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
c6147113
LP		 1100 if (r < 0)
1101 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
57fb9fb5 1102
4e1d6aa9 1103 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1104 break;
1105
17fe0523 1106 case ARG_BIND:
f757855e
LP		 1107 case ARG_BIND_RO:
1108 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1109 if (r < 0)
1110 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
17fe0523 1111
f757855e 1112 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
17fe0523 1113 break;
06c17c39 1114
f757855e
LP		 1115 case ARG_TMPFS:
1116 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1117 if (r < 0)
1118 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
5a8af538 1119
f757855e 1120 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
5a8af538 1121 break;
5a8af538
LP		 1122
1123 case ARG_OVERLAY:
ad85779a
LP		 1124 case ARG_OVERLAY_RO:
1125 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1126 if (r == -EADDRNOTAVAIL)
1127 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1128 if (r < 0)
1129 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
06c17c39 1130
f757855e 1131 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
06c17c39 1132 break;
06c17c39 1133
de40a303
LP		 1134 case ARG_INACCESSIBLE:
1135 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1136 if (r < 0)
1137 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1138
1139 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1140 break;
1141
0d2a0179
ZJS		 1142 case 'E':
1143 r = strv_env_replace_strdup_passthrough(&arg_setenv, optarg);
aaf057c4 1144 if (r < 0)
0d2a0179 1145 return log_error_errno(r, "Cannot assign environment variable %s: %m", optarg);
f4889f65 1146
f757855e 1147 arg_settings_mask |= SETTING_ENVIRONMENT;
f4889f65 1148 break;
f4889f65 1149
284c0b91
LP		 1150 case 'q':
1151 arg_quiet = true;
1152 break;
1153
8a96d94e 1154 case ARG_SHARE_SYSTEM:
a6b5216c 1155 /* We don't officially support this anymore, except for compat reasons. People should use the
0c582db0 1156 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
63d1c29f 1157 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
0c582db0 1158 arg_clone_ns_flags = 0;
8a96d94e
LP		 1159 break;
1160
eb91eb18
LP		 1161 case ARG_REGISTER:
1162 r = parse_boolean(optarg);
1163 if (r < 0) {
1164 log_error("Failed to parse --register= argument: %s", optarg);
1165 return r;
1166 }
1167
1168 arg_register = r;
1169 break;
1170
89f7c846
LP		 1171 case ARG_KEEP_UNIT:
1172 arg_keep_unit = true;
1173 break;
1174
6afc95b7
LP		 1175 case ARG_PERSONALITY:
1176
ac45f971 1177 arg_personality = personality_from_string(optarg);
baaa35ad
ZJS		 1178 if (arg_personality == PERSONALITY_INVALID)
1179 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1180 "Unknown or unsupported personality '%s'.", optarg);
6afc95b7 1181
f757855e 1182 arg_settings_mask |= SETTING_PERSONALITY;
6afc95b7
LP		 1183 break;
1184
4d9f07b4
LP		 1185 case ARG_VOLATILE:
1186
1187 if (!optarg)
f757855e 1188 arg_volatile_mode = VOLATILE_YES;
5c828e66
LP		 1189 else if (streq(optarg, "help")) {
1190 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1191 return 0;
1192 } else {
f757855e 1193 VolatileMode m;
4d9f07b4 1194
f757855e 1195 m = volatile_mode_from_string(optarg);
baaa35ad
ZJS		 1196 if (m < 0)
1197 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1198 "Failed to parse --volatile= argument: %s", optarg);
1199 else
f757855e 1200 arg_volatile_mode = m;
6d0b55c2
LP		 1201 }
1202
f757855e
LP		 1203 arg_settings_mask |= SETTING_VOLATILE_MODE;
1204 break;
6d0b55c2 1205
f757855e
LP		 1206 case 'p':
1207 r = expose_port_parse(&arg_expose_ports, optarg);
1208 if (r == -EEXIST)
1209 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1210 if (r < 0)
1211 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
6d0b55c2 1212
f757855e 1213 arg_settings_mask |= SETTING_EXPOSE_PORTS;
6d0b55c2 1214 break;
6d0b55c2 1215
f36933fe
LP		 1216 case ARG_PROPERTY:
1217 if (strv_extend(&arg_property, optarg) < 0)
1218 return log_oom();
1219
1220 break;
1221
ae209204 1222 case ARG_PRIVATE_USERS: {
33eac552 1223 int boolean;
0de7acce 1224
ae209204
ZJS		 1225 if (!optarg)
1226 boolean = true;
1227 else if (!in_charset(optarg, DIGITS))
1228 /* do *not* parse numbers as booleans */
1229 boolean = parse_boolean(optarg);
33eac552
LP		 1230 else
1231 boolean = -1;
ae209204 1232
33eac552 1233 if (boolean == 0) {
0de7acce
LP		 1234 /* no: User namespacing off */
1235 arg_userns_mode = USER_NAMESPACE_NO;
1236 arg_uid_shift = UID_INVALID;
1237 arg_uid_range = UINT32_C(0x10000);
33eac552 1238 } else if (boolean > 0) {
0de7acce
LP		 1239 /* yes: User namespacing on, UID range is read from root dir */
1240 arg_userns_mode = USER_NAMESPACE_FIXED;
1241 arg_uid_shift = UID_INVALID;
1242 arg_uid_range = UINT32_C(0x10000);
1243 } else if (streq(optarg, "pick")) {
1244 /* pick: User namespacing on, UID range is picked randomly */
6c045a99
LP		 1245 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1246 * implied by USER_NAMESPACE_PICK
33eac552 1247 * further down. */
0de7acce
LP		 1248 arg_uid_shift = UID_INVALID;
1249 arg_uid_range = UINT32_C(0x10000);
33eac552
LP		 1250
1251 } else if (streq(optarg, "identity")) {
1252 /* identitiy: User namespaces on, UID range is map the 0…0xFFFF range to
1253 * itself, i.e. we don't actually map anything, but do take benefit of
1254 * isolation of capability sets. */
1255 arg_userns_mode = USER_NAMESPACE_FIXED;
1256 arg_uid_shift = 0;
1257 arg_uid_range = UINT32_C(0x10000);
0de7acce 1258 } else {
6c2058b3 1259 _cleanup_free_ char *buffer = NULL;
6dac160c
LP		 1260 const char *range, *shift;
1261
0de7acce
LP		 1262 /* anything else: User namespacing on, UID range is explicitly configured */
1263
6dac160c
LP		 1264 range = strchr(optarg, ':');
1265 if (range) {
6c2058b3
ZJS		 1266 buffer = strndup(optarg, range - optarg);
1267 if (!buffer)
1268 return log_oom();
1269 shift = buffer;
6dac160c
LP		 1270
1271 range++;
bfd292ec
ZJS		 1272 r = safe_atou32(range, &arg_uid_range);
1273 if (r < 0)
be715731 1274 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
6dac160c
LP		 1275 } else
1276 shift = optarg;
1277
be715731
ZJS		 1278 r = parse_uid(shift, &arg_uid_shift);
1279 if (r < 0)
1280 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
0de7acce
LP		 1281
1282 arg_userns_mode = USER_NAMESPACE_FIXED;
6dac160c 1283
58e13de5
LP		 1284 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
1285 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID range cannot be empty or go beyond " UID_FMT ".", UID_INVALID);
1286 }
be715731 1287
0de7acce 1288 arg_settings_mask |= SETTING_USERNS;
6dac160c 1289 break;
ae209204 1290 }
6dac160c 1291
0de7acce 1292 case 'U':
ccabee0d 1293 if (userns_supported()) {
6c045a99
LP		 1294 arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_ownership is
1295 * implied by USER_NAMESPACE_PICK
33eac552 1296 * further down. */
ccabee0d
LP		 1297 arg_uid_shift = UID_INVALID;
1298 arg_uid_range = UINT32_C(0x10000);
1299
1300 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1301 }
1302
7336138e
LP		 1303 break;
1304
0de7acce 1305 case ARG_PRIVATE_USERS_CHOWN:
6c045a99
LP		 1306 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
1307
1308 arg_settings_mask |= SETTING_USERNS;
1309 break;
1310
1311 case ARG_PRIVATE_USERS_OWNERSHIP:
1312 if (streq(optarg, "help")) {
1313 DUMP_STRING_TABLE(user_namespace_ownership, UserNamespaceOwnership, _USER_NAMESPACE_OWNERSHIP_MAX);
1314 return 0;
1315 }
1316
1317 arg_userns_ownership = user_namespace_ownership_from_string(optarg);
1318 if (arg_userns_ownership < 0)
1319 return log_error_errno(arg_userns_ownership, "Cannot parse --user-namespace-ownership= value: %s", optarg);
0de7acce
LP		 1320
1321 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1322 break;
1323
c6c8f6e2 1324 case ARG_KILL_SIGNAL:
5c828e66
LP		 1325 if (streq(optarg, "help")) {
1326 DUMP_STRING_TABLE(signal, int, _NSIG);
1327 return 0;
1328 }
1329
29a3db75 1330 arg_kill_signal = signal_from_string(optarg);
baaa35ad 1331 if (arg_kill_signal < 0)
7211c853 1332 return log_error_errno(arg_kill_signal, "Cannot parse signal: %s", optarg);
c6c8f6e2 1333
f757855e
LP		 1334 arg_settings_mask |= SETTING_KILL_SIGNAL;
1335 break;
1336
1337 case ARG_SETTINGS:
1338
1339 /* no → do not read files
1340 * yes → read files, do not override cmdline, trust only subset
1341 * override → read files, override cmdline, trust only subset
1342 * trusted → read files, do not override cmdline, trust all
1343 */
1344
1345 r = parse_boolean(optarg);
1346 if (r < 0) {
1347 if (streq(optarg, "trusted")) {
1348 mask_all_settings = false;
1349 mask_no_settings = false;
1350 arg_settings_trusted = true;
1351
1352 } else if (streq(optarg, "override")) {
1353 mask_all_settings = false;
1354 mask_no_settings = true;
1355 arg_settings_trusted = -1;
1356 } else
1357 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1358 } else if (r > 0) {
1359 /* yes */
1360 mask_all_settings = false;
1361 mask_no_settings = false;
1362 arg_settings_trusted = -1;
1363 } else {
1364 /* no */
1365 mask_all_settings = true;
1366 mask_no_settings = false;
1367 arg_settings_trusted = false;
1368 }
1369
c6c8f6e2
LP		 1370 break;
1371
5f932eb9 1372 case ARG_CHDIR:
baaa35ad
ZJS		 1373 if (!path_is_absolute(optarg))
1374 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1375 "Working directory %s is not an absolute path.", optarg);
5f932eb9
LP		 1376
1377 r = free_and_strdup(&arg_chdir, optarg);
1378 if (r < 0)
1379 return log_oom();
1380
1381 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1382 break;
1383
b53ede69
PW		 1384 case ARG_PIVOT_ROOT:
1385 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1386 if (r < 0)
1387 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1388
1389 arg_settings_mask |= SETTING_PIVOT_ROOT;
1390 break;
1391
9c1e04d0
AP		 1392 case ARG_NOTIFY_READY:
1393 r = parse_boolean(optarg);
baaa35ad
ZJS		 1394 if (r < 0)
1395 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1396 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
9c1e04d0
AP		 1397 arg_notify_ready = r;
1398 arg_settings_mask |= SETTING_NOTIFY_READY;
1399 break;
1400
4623e8e6 1401 case ARG_ROOT_HASH: {
89e62e0b 1402 _cleanup_free_ void *k = NULL;
4623e8e6
LP		 1403 size_t l;
1404
1405 r = unhexmem(optarg, strlen(optarg), &k, &l);
1406 if (r < 0)
1407 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
89e62e0b 1408 if (l < sizeof(sd_id128_t))
c6147113 1409 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
4623e8e6 1410
89e62e0b
LP		 1411 free_and_replace(arg_verity_settings.root_hash, k);
1412 arg_verity_settings.root_hash_size = l;
4623e8e6
LP		 1413 break;
1414 }
1415
c2923fdc
LB		 1416 case ARG_ROOT_HASH_SIG: {
1417 char *value;
89e62e0b
LP		 1418 size_t l;
1419 void *p;
c2923fdc
LB		 1420
1421 if ((value = startswith(optarg, "base64:"))) {
c2923fdc
LB		 1422 r = unbase64mem(value, strlen(value), &p, &l);
1423 if (r < 0)
1424 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1425
c2923fdc 1426 } else {
89e62e0b 1427 r = read_full_file(optarg, (char**) &p, &l);
c2923fdc 1428 if (r < 0)
89e62e0b 1429 return log_error_errno(r, "Failed parse root hash signature file '%s': %m", optarg);
c2923fdc
LB		 1430 }
1431
89e62e0b
LP		 1432 free_and_replace(arg_verity_settings.root_hash_sig, p);
1433 arg_verity_settings.root_hash_sig_size = l;
c2923fdc
LB		 1434 break;
1435 }
1436
89e62e0b 1437 case ARG_VERITY_DATA:
614b022c 1438 r = parse_path_argument(optarg, false, &arg_verity_settings.data_path);
89e62e0b
LP		 1439 if (r < 0)
1440 return r;
1441 break;
1442
960e4569
LP		 1443 case ARG_SYSTEM_CALL_FILTER: {
1444 bool negative;
1445 const char *items;
1446
1447 negative = optarg[0] == '~';
1448 items = negative ? optarg + 1 : optarg;
1449
1450 for (;;) {
1451 _cleanup_free_ char *word = NULL;
1452
1453 r = extract_first_word(&items, &word, NULL, 0);
1454 if (r == 0)
1455 break;
1456 if (r == -ENOMEM)
1457 return log_oom();
1458 if (r < 0)
1459 return log_error_errno(r, "Failed to parse system call filter: %m");
1460
1461 if (negative)
6b000af4 1462 r = strv_extend(&arg_syscall_deny_list, word);
960e4569 1463 else
6b000af4 1464 r = strv_extend(&arg_syscall_allow_list, word);
960e4569
LP		 1465 if (r < 0)
1466 return log_oom();
1467 }
1468
1469 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1470 break;
1471 }
1472
bf428efb
LP		 1473 case ARG_RLIMIT: {
1474 const char *eq;
622ecfa8 1475 _cleanup_free_ char *name = NULL;
bf428efb
LP		 1476 int rl;
1477
5c828e66
LP		 1478 if (streq(optarg, "help")) {
1479 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1480 return 0;
1481 }
1482
bf428efb 1483 eq = strchr(optarg, '=');
baaa35ad
ZJS		 1484 if (!eq)
1485 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1486 "--rlimit= expects an '=' assignment.");
bf428efb
LP		 1487
1488 name = strndup(optarg, eq - optarg);
1489 if (!name)
1490 return log_oom();
1491
1492 rl = rlimit_from_string_harder(name);
baaa35ad 1493 if (rl < 0)
7211c853 1494 return log_error_errno(rl, "Unknown resource limit: %s", name);
bf428efb
LP		 1495
1496 if (!arg_rlimit[rl]) {
1497 arg_rlimit[rl] = new0(struct rlimit, 1);
1498 if (!arg_rlimit[rl])
1499 return log_oom();
1500 }
1501
1502 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1503 if (r < 0)
1504 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1505
1506 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1507 break;
1508 }
1509
81f345df
LP		 1510 case ARG_OOM_SCORE_ADJUST:
1511 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1512 if (r < 0)
1513 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1514
1515 arg_oom_score_adjust_set = true;
1516 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1517 break;
1518
d107bb7d 1519 case ARG_CPU_AFFINITY: {
0985c7c4 1520 CPUSet cpuset;
d107bb7d
LP		 1521
1522 r = parse_cpu_set(optarg, &cpuset);
1523 if (r < 0)
0985c7c4 1524 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
d107bb7d 1525
0985c7c4
ZJS		 1526 cpu_set_reset(&arg_cpu_set);
1527 arg_cpu_set = cpuset;
d107bb7d
LP		 1528 arg_settings_mask |= SETTING_CPU_AFFINITY;
1529 break;
1530 }
1531
09d423e9
LP		 1532 case ARG_RESOLV_CONF:
1533 if (streq(optarg, "help")) {
1534 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1535 return 0;
1536 }
1537
1538 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
baaa35ad 1539 if (arg_resolv_conf < 0)
7211c853 1540 return log_error_errno(arg_resolv_conf,
baaa35ad 1541 "Failed to parse /etc/resolv.conf mode: %s", optarg);
09d423e9
LP		 1542
1543 arg_settings_mask |= SETTING_RESOLV_CONF;
1544 break;
1545
1688841f
LP		 1546 case ARG_TIMEZONE:
1547 if (streq(optarg, "help")) {
1548 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1549 return 0;
1550 }
1551
1552 arg_timezone = timezone_mode_from_string(optarg);
baaa35ad 1553 if (arg_timezone < 0)
7211c853 1554 return log_error_errno(arg_timezone,
baaa35ad 1555 "Failed to parse /etc/localtime mode: %s", optarg);
1688841f
LP		 1556
1557 arg_settings_mask |= SETTING_TIMEZONE;
1558 break;
1559
de40a303 1560 case ARG_CONSOLE:
dce66ffe
ZJS		 1561 r = handle_arg_console(optarg);
1562 if (r <= 0)
1563 return r;
de40a303
LP		 1564 break;
1565
1566 case 'P':
1567 case ARG_PIPE:
dce66ffe
ZJS		 1568 r = handle_arg_console("pipe");
1569 if (r <= 0)
1570 return r;
de40a303
LP		 1571 break;
1572
bb068de0
ZJS		 1573 case ARG_NO_PAGER:
1574 arg_pager_flags |= PAGER_DISABLE;
1575 break;
1576
3652872a
LP		 1577 case ARG_SET_CREDENTIAL: {
1578 _cleanup_free_ char *word = NULL, *data = NULL;
1579 const char *p = optarg;
1580 Credential *a;
e437538f 1581 ssize_t l;
3652872a
LP		 1582
1583 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1584 if (r == -ENOMEM)
1585 return log_oom();
1586 if (r < 0)
1587 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1588 if (r == 0 || !p)
1589 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1590
1591 if (!credential_name_valid(word))
1592 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1593
12d729b2 1594 for (size_t i = 0; i < arg_n_credentials; i++)
3652872a
LP		 1595 if (streq(arg_credentials[i].id, word))
1596 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1597
1598 l = cunescape(p, UNESCAPE_ACCEPT_NUL, &data);
1599 if (l < 0)
1600 return log_error_errno(l, "Failed to unescape credential data: %s", p);
1601
1602 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1603 if (!a)
1604 return log_oom();
1605
1606 a[arg_n_credentials++] = (Credential) {
1607 .id = TAKE_PTR(word),
1608 .data = TAKE_PTR(data),
1609 .size = l,
1610 };
1611
1612 arg_credentials = a;
1613
1614 arg_settings_mask |= SETTING_CREDENTIALS;
1615 break;
1616 }
1617
1618 case ARG_LOAD_CREDENTIAL: {
1619 ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
1620 _cleanup_(erase_and_freep) char *data = NULL;
1621 _cleanup_free_ char *word = NULL, *j = NULL;
1622 const char *p = optarg;
1623 Credential *a;
1624 size_t size, i;
1625
1626 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1627 if (r == -ENOMEM)
1628 return log_oom();
1629 if (r < 0)
1630 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1631 if (r == 0 || !p)
1632 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1633
1634 if (!credential_name_valid(word))
1635 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1636
1637 for (i = 0; i < arg_n_credentials; i++)
1638 if (streq(arg_credentials[i].id, word))
1639 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1640
1641 if (path_is_absolute(p))
1642 flags |= READ_FULL_FILE_CONNECT_SOCKET;
1643 else {
1644 const char *e;
1645
786d19fd
LP		 1646 r = get_credentials_dir(&e);
1647 if (r < 0)
1648 return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
3652872a
LP		 1649
1650 j = path_join(e, p);
1651 if (!j)
1652 return log_oom();
1653 }
1654
986311c2
LP		 1655 r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
1656 flags,
1657 NULL,
1658 &data, &size);
3652872a
LP		 1659 if (r < 0)
1660 return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
1661
1662 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1663 if (!a)
1664 return log_oom();
1665
1666 a[arg_n_credentials++] = (Credential) {
1667 .id = TAKE_PTR(word),
1668 .data = TAKE_PTR(data),
1669 .size = size,
1670 };
1671
1672 arg_credentials = a;
1673
1674 arg_settings_mask |= SETTING_CREDENTIALS;
1675 break;
1676 }
1677
2f893044
LP		 1678 case ARG_BIND_USER:
1679 if (!valid_user_group_name(optarg, 0))
1680 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid user name to bind: %s", optarg);
1681
1682 if (strv_extend(&arg_bind_user, optarg) < 0)
1683 return log_oom();
1684
1685 arg_settings_mask |= SETTING_BIND_USER;
1686 break;
1687
4a4654e0
LP		 1688 case ARG_SUPPRESS_SYNC:
1689 r = parse_boolean_argument("--suppress-sync=", optarg, &arg_suppress_sync);
1690 if (r < 0)
1691 return r;
1692
1693 arg_settings_mask |= SETTING_SUPPRESS_SYNC;
1694 break;
1695
88213476
LP		 1696 case '?':
1697 return -EINVAL;
1698
1699 default:
04499a70 1700 assert_not_reached();
88213476 1701 }
88213476 1702
60f1ec13
LP		 1703 if (argc > optind) {
1704 strv_free(arg_parameters);
1705 arg_parameters = strv_copy(argv + optind);
1706 if (!arg_parameters)
1707 return log_oom();
d7bea6b6 1708
60f1ec13
LP		 1709 arg_settings_mask |= SETTING_START_MODE;
1710 }
1711
1712 if (arg_ephemeral && arg_template && !arg_directory)
1713 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1714 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1715 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1716 * --directory=". */
1717 arg_directory = TAKE_PTR(arg_template);
1718
bd4b15f2 1719 arg_caps_retain = (arg_caps_retain | plus | (arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0)) & ~minus;
60f1ec13 1720
de40a303 1721 /* Make sure to parse environment before we reset the settings mask below */
49048684
ZJS		 1722 r = parse_environment();
1723 if (r < 0)
1724 return r;
de40a303 1725
60f1ec13
LP		 1726 /* Load all settings from .nspawn files */
1727 if (mask_no_settings)
1728 arg_settings_mask = 0;
1729
1730 /* Don't load any settings from .nspawn files */
1731 if (mask_all_settings)
1732 arg_settings_mask = _SETTINGS_MASK_ALL;
1733
1734 return 1;
1735}
1736
1737static int verify_arguments(void) {
1738 int r;
a6b5216c 1739
75b0d8b8
ZJS		 1740 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1741 /* If we are running the stub init in the container, we don't need to look at what the init
1742 * in the container supports, because we are not using it. Let's immediately pick the right
1743 * setting based on the host system configuration.
1744 *
1745 * We only do this, if the user didn't use an environment variable to override the detection.
1746 */
1747
1748 r = cg_all_unified();
1749 if (r < 0)
1750 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1751 if (r > 0)
1752 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1753 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1754 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1755 else
1756 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1757 }
1758
4f086aab
SU		 1759 if (arg_userns_mode != USER_NAMESPACE_NO)
1760 arg_mount_settings |= MOUNT_USE_USERNS;
1761
1762 if (arg_private_network)
1763 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1764
48a8d337
LB		 1765 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1766 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
eb91eb18 1767 arg_register = false;
baaa35ad 1768 if (arg_start_mode != START_PID1)
60f1ec13 1769 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
0c582db0 1770 }
eb91eb18 1771
6c045a99
LP		 1772 if (arg_userns_ownership < 0)
1773 arg_userns_ownership =
f61c7f88 1774 arg_userns_mode == USER_NAMESPACE_PICK ? USER_NAMESPACE_OWNERSHIP_AUTO :
6c045a99 1775 USER_NAMESPACE_OWNERSHIP_OFF;
0e7ac751 1776
60f1ec13
LP		 1777 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1778 arg_kill_signal = SIGRTMIN+3;
1779
e5a4bb0d
LP		 1780 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1781 arg_read_only = true;
1782
2436ea76
DDM		 1783 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1784 arg_read_only = true;
1785
baaa35ad 1786 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
8d9c2bca
AJ		 1787 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1788 * The latter is not technically a user session, but we don't need to labour the point. */
60f1ec13 1789 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
89f7c846 1790
baaa35ad 1791 if (arg_directory && arg_image)
60f1ec13 1792 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1b9e5b12 1793
baaa35ad 1794 if (arg_template && arg_image)
60f1ec13 1795 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
8cd328d8 1796
baaa35ad 1797 if (arg_template && !(arg_directory || arg_machine))
60f1ec13 1798 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
ec16945e 1799
baaa35ad 1800 if (arg_ephemeral && arg_template)
60f1ec13 1801 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
ec16945e 1802
baaa35ad 1803 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
60f1ec13 1804 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
df9a75e4 1805
baaa35ad 1806 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
60f1ec13 1807 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
7336138e 1808
6c045a99 1809 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_read_only)
de40a303 1810 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
6c045a99 1811 "--read-only and --private-users-ownership=chown may not be combined.");
f757855e 1812
6c045a99
LP		 1813 /* We don't support --private-users-ownership=chown together with any of the volatile modes since we
1814 * couldn't change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a
1815 * massive copy-up (in case of overlay) making the entire exercise pointless. */
1816 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_CHOWN && arg_volatile_mode != VOLATILE_NO)
1817 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-ownership=chown may not be combined.");
e5a4bb0d 1818
679ecd36
SZ		 1819 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1820 * we need to error out, to avoid conflicts between different network options. */
60f1ec13
LP		 1821 if (arg_network_namespace_path &&
1822 (arg_network_interfaces || arg_network_macvlan ||
1823 arg_network_ipvlan || arg_network_veth_extra ||
1824 arg_network_bridge || arg_network_zone ||
679ecd36 1825 arg_network_veth))
de40a303 1826 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
86c0dd4a 1827
60f1ec13 1828 if (arg_network_bridge && arg_network_zone)
de40a303
LP		 1829 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1830 "--network-bridge= and --network-zone= may not be combined.");
f757855e 1831
baaa35ad 1832 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
60f1ec13 1833 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
4f086aab 1834
baaa35ad 1835 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
60f1ec13 1836 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
f757855e 1837
baaa35ad 1838 if (arg_expose_ports && !arg_private_network)
60f1ec13 1839 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
6d0b55c2 1840
88fc9c9b 1841 if (arg_caps_ambient) {
f5fbe71d 1842 if (arg_caps_ambient == UINT64_MAX)
88fc9c9b
TH		 1843 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= does not support the value all.");
1844
1845 if ((arg_caps_ambient & arg_caps_retain) != arg_caps_ambient)
1846 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not fully covered by Capability= setting.");
1847
1848 if (arg_start_mode == START_BOOT)
1849 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not useful for boot mode.");
1850 }
1851
2f893044
LP		 1852 if (arg_userns_mode == USER_NAMESPACE_NO && !strv_isempty(arg_bind_user))
1853 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--bind-user= requires --private-users");
1854
1855 /* Drop duplicate --bind-user= entries */
1856 strv_uniq(arg_bind_user);
1857
60f1ec13
LP		 1858 r = custom_mount_check_all();
1859 if (r < 0)
1860 return r;
c6c8f6e2 1861
f757855e 1862 return 0;
88213476
LP		 1863}
1864
91181e07 1865int userns_lchown(const char *p, uid_t uid, gid_t gid) {
03cfe0d5
LP		 1866 assert(p);
1867
0de7acce 1868 if (arg_userns_mode == USER_NAMESPACE_NO)
03cfe0d5
LP		 1869 return 0;
1870
1871 if (uid == UID_INVALID && gid == GID_INVALID)
1872 return 0;
1873
1874 if (uid != UID_INVALID) {
1875 uid += arg_uid_shift;
1876
1877 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1878 return -EOVERFLOW;
1879 }
1880
1881 if (gid != GID_INVALID) {
1882 gid += (gid_t) arg_uid_shift;
1883
1884 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1885 return -EOVERFLOW;
1886 }
1887
7c248223 1888 return RET_NERRNO(lchown(p, uid, gid));
b12afc8c
LP		 1889}
1890
91181e07 1891int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
03cfe0d5 1892 const char *q;
dae8b82e 1893 int r;
03cfe0d5
LP		 1894
1895 q = prefix_roota(root, path);
3f692e2e 1896 r = RET_NERRNO(mkdir(q, mode));
dae8b82e
ZJS		 1897 if (r == -EEXIST)
1898 return 0;
1899 if (r < 0)
1900 return r;
03cfe0d5
LP		 1901
1902 return userns_lchown(q, uid, gid);
1903}
1904
1688841f 1905static const char *timezone_from_path(const char *path) {
da9fc98d
LP		 1906 return PATH_STARTSWITH_SET(
1907 path,
1908 "../usr/share/zoneinfo/",
1909 "/usr/share/zoneinfo/");
1688841f
LP		 1910}
1911
83205269
LP		 1912static bool etc_writable(void) {
1913 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1914}
1915
e58a1277 1916static int setup_timezone(const char *dest) {
1688841f
LP		 1917 _cleanup_free_ char *p = NULL, *etc = NULL;
1918 const char *where, *check;
1919 TimezoneMode m;
d4036145 1920 int r;
f8440af5 1921
e58a1277
LP		 1922 assert(dest);
1923
1688841f 1924 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1688841f
LP		 1925 r = readlink_malloc("/etc/localtime", &p);
1926 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
83205269 1927 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1688841f 1928 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
83205269 1929 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1688841f
LP		 1930 else if (r < 0) {
1931 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1932 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1933 * file.
1934 *
1935 * Example:
1936 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1937 */
1938 return 0;
1939 } else if (arg_timezone == TIMEZONE_AUTO)
83205269 1940 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1688841f
LP		 1941 else
1942 m = arg_timezone;
1943 } else
1944 m = arg_timezone;
1945
1946 if (m == TIMEZONE_OFF)
1947 return 0;
1948
a5648b80 1949 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
d4036145 1950 if (r < 0) {
1688841f 1951 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
d4036145
LP		 1952 return 0;
1953 }
1954
1688841f
LP		 1955 where = strjoina(etc, "/localtime");
1956
1957 switch (m) {
1958
1959 case TIMEZONE_DELETE:
1960 if (unlink(where) < 0)
1961 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1962
d4036145 1963 return 0;
d4036145 1964
1688841f
LP		 1965 case TIMEZONE_SYMLINK: {
1966 _cleanup_free_ char *q = NULL;
1967 const char *z, *what;
4d1c38b8 1968
1688841f
LP		 1969 z = timezone_from_path(p);
1970 if (!z) {
1971 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
d4036145 1972 return 0;
1688841f 1973 }
d4036145 1974
1688841f
LP		 1975 r = readlink_malloc(where, &q);
1976 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1977 return 0; /* Already pointing to the right place? Then do nothing .. */
1978
1979 check = strjoina(dest, "/usr/share/zoneinfo/", z);
a5648b80 1980 r = chase_symlinks(check, dest, 0, NULL, NULL);
1688841f
LP		 1981 if (r < 0)
1982 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1983 else {
1984 if (unlink(where) < 0 && errno != ENOENT) {
1985 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1986 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1987 return 0;
1988 }
1989
1990 what = strjoina("../usr/share/zoneinfo/", z);
1991 if (symlink(what, where) < 0) {
1992 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
1993 errno, "Failed to correct timezone of container, ignoring: %m");
1994 return 0;
1995 }
1996
1997 break;
1998 }
1999
2000 _fallthrough_;
d4036145 2001 }
68fb0892 2002
1688841f
LP		 2003 case TIMEZONE_BIND: {
2004 _cleanup_free_ char *resolved = NULL;
2005 int found;
2006
a5648b80 2007 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
1688841f
LP		 2008 if (found < 0) {
2009 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
2010 return 0;
2011 }
2012
2013 if (found == 0) /* missing? */
2014 (void) touch(resolved);
2015
511a8cfe 2016 r = mount_nofollow_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
1688841f 2017 if (r >= 0)
511a8cfe 2018 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
1688841f
LP		 2019
2020 _fallthrough_;
79d80fc1 2021 }
4d9f07b4 2022
1688841f
LP		 2023 case TIMEZONE_COPY:
2024 /* If mounting failed, try to copy */
8a016c74 2025 r = copy_file_atomic("/etc/localtime", where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
1688841f
LP		 2026 if (r < 0) {
2027 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
2028 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
2029 return 0;
2030 }
2031
2032 break;
2033
2034 default:
04499a70 2035 assert_not_reached();
d4036145 2036 }
e58a1277 2037
1688841f 2038 /* Fix permissions of the symlink or file copy we just created */
03cfe0d5
LP		 2039 r = userns_lchown(where, 0, 0);
2040 if (r < 0)
1688841f 2041 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
03cfe0d5 2042
e58a1277 2043 return 0;
88213476
LP		 2044}
2045
09d423e9
LP		 2046static int have_resolv_conf(const char *path) {
2047 assert(path);
2048
2049 if (access(path, F_OK) < 0) {
2050 if (errno == ENOENT)
2051 return 0;
2052
2053 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
2054 }
2055
2056 return 1;
2057}
2058
7357272e 2059static int resolved_listening(void) {
b8ea7a6e 2060 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
b053cd5f 2061 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
7357272e 2062 _cleanup_free_ char *dns_stub_listener_mode = NULL;
b053cd5f
LP		 2063 int r;
2064
7357272e 2065 /* Check if resolved is listening */
b053cd5f
LP		 2066
2067 r = sd_bus_open_system(&bus);
2068 if (r < 0)
b8ea7a6e 2069 return log_debug_errno(r, "Failed to open system bus: %m");
b053cd5f 2070
7357272e 2071 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
b8ea7a6e
LP		 2072 if (r < 0)
2073 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
2074 if (r == 0)
2075 return 0;
7357272e
DM		 2076
2077 r = sd_bus_get_property_string(bus,
2078 "org.freedesktop.resolve1",
2079 "/org/freedesktop/resolve1",
2080 "org.freedesktop.resolve1.Manager",
2081 "DNSStubListener",
b8ea7a6e 2082 &error,
7357272e
DM		 2083 &dns_stub_listener_mode);
2084 if (r < 0)
b8ea7a6e 2085 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
7357272e
DM		 2086
2087 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
b053cd5f
LP		 2088}
2089
2547bb41 2090static int setup_resolv_conf(const char *dest) {
09d423e9
LP		 2091 _cleanup_free_ char *etc = NULL;
2092 const char *where, *what;
2093 ResolvConfMode m;
2094 int r;
2547bb41
LP		 2095
2096 assert(dest);
2097
09d423e9
LP		 2098 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
2099 if (arg_private_network)
2100 m = RESOLV_CONF_OFF;
86775e35
LP		 2101 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
2102 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
09d423e9 2103 else if (have_resolv_conf("/etc/resolv.conf") > 0)
83205269 2104 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
09d423e9 2105 else
83205269 2106 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
86775e35 2107
09d423e9
LP		 2108 } else
2109 m = arg_resolv_conf;
2110
2111 if (m == RESOLV_CONF_OFF)
2547bb41
LP		 2112 return 0;
2113
a5648b80 2114 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
87447ae4
LP		 2115 if (r < 0) {
2116 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
2117 return 0;
2118 }
2119
2120 where = strjoina(etc, "/resolv.conf");
09d423e9
LP		 2121
2122 if (m == RESOLV_CONF_DELETE) {
2123 if (unlink(where) < 0)
2124 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
2125
87447ae4
LP		 2126 return 0;
2127 }
79d80fc1 2128
86775e35
LP		 2129 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
2130 what = PRIVATE_STATIC_RESOLV_CONF;
2131 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
2132 what = PRIVATE_UPLINK_RESOLV_CONF;
2133 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
2134 what = PRIVATE_STUB_RESOLV_CONF;
09d423e9
LP		 2135 else
2136 what = "/etc/resolv.conf";
87447ae4 2137
86775e35 2138 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
09d423e9
LP		 2139 _cleanup_free_ char *resolved = NULL;
2140 int found;
2141
a5648b80 2142 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
09d423e9
LP		 2143 if (found < 0) {
2144 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
2145 return 0;
2146 }
3539724c 2147
87447ae4
LP		 2148 if (found == 0) /* missing? */
2149 (void) touch(resolved);
5367354d 2150
511a8cfe 2151 r = mount_nofollow_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
60e76d48 2152 if (r >= 0)
511a8cfe 2153 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
86775e35
LP		 2154
2155 /* If that didn't work, let's copy the file */
3539724c
LP		 2156 }
2157
86775e35
LP		 2158 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
2159 r = copy_file_atomic(what, where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
2160 else
2161 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, 0, 0, COPY_REFLINK);
79d80fc1 2162 if (r < 0) {
3539724c
LP		 2163 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
2164 * resolved or something similar runs inside and the symlink points there.
68a313c5 2165 *
3539724c 2166 * If the disk image is read-only, there's also no point in complaining.
68a313c5 2167 */
86775e35
LP		 2168 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
2169 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
3539724c 2170 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
79d80fc1
TG		 2171 return 0;
2172 }
2547bb41 2173
03cfe0d5
LP		 2174 r = userns_lchown(where, 0, 0);
2175 if (r < 0)
3539724c 2176 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
03cfe0d5 2177
2547bb41
LP		 2178 return 0;
2179}
2180
1e4f1671 2181static int setup_boot_id(void) {
cdde6ba6
LP		 2182 _cleanup_(unlink_and_freep) char *from = NULL;
2183 _cleanup_free_ char *path = NULL;
3bbaff3e 2184 sd_id128_t rnd = SD_ID128_NULL;
cdde6ba6 2185 const char *to;
04bc4a3f
LP		 2186 int r;
2187
1eacc470 2188 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
04bc4a3f 2189
1eacc470 2190 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
cdde6ba6
LP		 2191 if (r < 0)
2192 return log_error_errno(r, "Failed to generate random boot ID path: %m");
04bc4a3f
LP		 2193
2194 r = sd_id128_randomize(&rnd);
f647962d
MS		 2195 if (r < 0)
2196 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 2197
cdde6ba6 2198 r = id128_write(path, ID128_UUID, rnd, false);
f647962d
MS		 2199 if (r < 0)
2200 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 2201
cdde6ba6
LP		 2202 from = TAKE_PTR(path);
2203 to = "/proc/sys/kernel/random/boot_id";
2204
511a8cfe 2205 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
cdde6ba6
LP		 2206 if (r < 0)
2207 return r;
04bc4a3f 2208
511a8cfe 2209 return mount_nofollow_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
04bc4a3f
LP		 2210}
2211
e58a1277 2212static int copy_devnodes(const char *dest) {
88213476
LP		 2213 static const char devnodes[] =
2214 "null\0"
2215 "zero\0"
2216 "full\0"
2217 "random\0"
2218 "urandom\0"
85614d66
TG		 2219 "tty\0"
2220 "net/tun\0";
88213476
LP		 2221
2222 const char *d;
e58a1277 2223 int r = 0;
a258bf26
LP		 2224
2225 assert(dest);
124640f1 2226
52f05ef2 2227 BLOCK_WITH_UMASK(0000);
88213476 2228
03cfe0d5
LP		 2229 /* Create /dev/net, so that we can create /dev/net/tun in it */
2230 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2231 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2232
88213476 2233 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 2234 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 2235 struct stat st;
88213476 2236
c6134d3e 2237 from = path_join("/dev/", d);
8967f291
LP		 2238 if (!from)
2239 return log_oom();
2240
c6134d3e 2241 to = path_join(dest, from);
8967f291
LP		 2242 if (!to)
2243 return log_oom();
88213476
LP		 2244
2245 if (stat(from, &st) < 0) {
2246
4a62c710
MS		 2247 if (errno != ENOENT)
2248 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 2249
baaa35ad
ZJS		 2250 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2251 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2252 "%s is not a char or block device, cannot copy.", from);
2253 else {
8dfce114
LP		 2254 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2255
81f5049b 2256 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
8dbf71ec 2257 /* Explicitly warn the user when /dev is already populated. */
41eb4362 2258 if (errno == EEXIST)
8dbf71ec 2259 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
81f5049b
AC		 2260 if (errno != EPERM)
2261 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2262
8dfce114 2263 /* Some systems abusively restrict mknod but allow bind mounts. */
81f5049b
AC		 2264 r = touch(to);
2265 if (r < 0)
2266 return log_error_errno(r, "touch (%s) failed: %m", to);
511a8cfe 2267 r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2268 if (r < 0)
2269 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
81f5049b 2270 }
6278cf60 2271
03cfe0d5
LP		 2272 r = userns_lchown(to, 0, 0);
2273 if (r < 0)
2274 return log_error_errno(r, "chown() of device node %s failed: %m", to);
8dfce114 2275
657ee2d8 2276 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
8dfce114
LP		 2277 if (!dn)
2278 return log_oom();
2279
2280 r = userns_mkdir(dest, dn, 0755, 0, 0);
2281 if (r < 0)
2282 return log_error_errno(r, "Failed to create '%s': %m", dn);
2283
2284 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2285 return log_oom();
2286
c6134d3e 2287 prefixed = path_join(dest, sl);
8dfce114
LP		 2288 if (!prefixed)
2289 return log_oom();
2290
2d9b74ba 2291 t = path_join("..", d);
8dfce114
LP		 2292 if (!t)
2293 return log_oom();
2294
2295 if (symlink(t, prefixed) < 0)
2296 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
88213476 2297 }
88213476
LP		 2298 }
2299
e58a1277
LP		 2300 return r;
2301}
88213476 2302
de40a303 2303static int make_extra_nodes(const char *dest) {
de40a303
LP		 2304 size_t i;
2305 int r;
2306
52f05ef2 2307 BLOCK_WITH_UMASK(0000);
de40a303
LP		 2308
2309 for (i = 0; i < arg_n_extra_nodes; i++) {
2310 _cleanup_free_ char *path = NULL;
2311 DeviceNode *n = arg_extra_nodes + i;
2312
c6134d3e 2313 path = path_join(dest, n->path);
de40a303
LP		 2314 if (!path)
2315 return log_oom();
2316
2317 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2318 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2319
2320 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2321 if (r < 0)
2322 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2323 }
2324
2325 return 0;
2326}
2327
03cfe0d5
LP		 2328static int setup_pts(const char *dest) {
2329 _cleanup_free_ char *options = NULL;
2330 const char *p;
709f6e46 2331 int r;
03cfe0d5 2332
349cc4a5 2333#if HAVE_SELINUX
03cfe0d5
LP		 2334 if (arg_selinux_apifs_context)
2335 (void) asprintf(&options,
3dce8915 2336 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 2337 arg_uid_shift + TTY_GID,
2338 arg_selinux_apifs_context);
2339 else
2340#endif
2341 (void) asprintf(&options,
3dce8915 2342 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 2343 arg_uid_shift + TTY_GID);
f2d88580 2344
03cfe0d5 2345 if (!options)
f2d88580
LP		 2346 return log_oom();
2347
03cfe0d5 2348 /* Mount /dev/pts itself */
cc9fce65 2349 p = prefix_roota(dest, "/dev/pts");
3f692e2e 2350 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e
ZJS		 2351 if (r < 0)
2352 return log_error_errno(r, "Failed to create /dev/pts: %m");
2353
511a8cfe 2354 r = mount_nofollow_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
60e76d48
ZJS		 2355 if (r < 0)
2356 return r;
709f6e46
MS		 2357 r = userns_lchown(p, 0, 0);
2358 if (r < 0)
2359 return log_error_errno(r, "Failed to chown /dev/pts: %m");
03cfe0d5
LP		 2360
2361 /* Create /dev/ptmx symlink */
2362 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 2363 if (symlink("pts/ptmx", p) < 0)
2364 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
709f6e46
MS		 2365 r = userns_lchown(p, 0, 0);
2366 if (r < 0)
2367 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
f2d88580 2368
03cfe0d5
LP		 2369 /* And fix /dev/pts/ptmx ownership */
2370 p = prefix_roota(dest, "/dev/pts/ptmx");
709f6e46
MS		 2371 r = userns_lchown(p, 0, 0);
2372 if (r < 0)
2373 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 2374
f2d88580
LP		 2375 return 0;
2376}
2377
3acc84eb 2378static int setup_stdio_as_dev_console(void) {
2fef50cd 2379 _cleanup_close_ int terminal = -1;
e58a1277 2380 int r;
e58a1277 2381
335d2ead
LP		 2382 /* We open the TTY in O_NOCTTY mode, so that we do not become controller yet. We'll do that later
2383 * explicitly, if we are configured to. */
2384 terminal = open_terminal("/dev/console", O_RDWR|O_NOCTTY);
3acc84eb
FB		 2385 if (terminal < 0)
2386 return log_error_errno(terminal, "Failed to open console: %m");
e58a1277 2387
3acc84eb
FB		 2388 /* Make sure we can continue logging to the original stderr, even if
2389 * stderr points elsewhere now */
2390 r = log_dup_console();
2391 if (r < 0)
2392 return log_error_errno(r, "Failed to duplicate stderr: %m");
de40a303 2393
3acc84eb
FB		 2394 /* invalidates 'terminal' on success and failure */
2395 r = rearrange_stdio(terminal, terminal, terminal);
2fef50cd 2396 TAKE_FD(terminal);
f647962d 2397 if (r < 0)
3acc84eb
FB		 2398 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2399
2400 return 0;
2401}
88213476 2402
3acc84eb
FB		 2403static int setup_dev_console(const char *console) {
2404 _cleanup_free_ char *p = NULL;
2405 int r;
a258bf26 2406
3acc84eb
FB		 2407 /* Create /dev/console symlink */
2408 r = path_make_relative("/dev", console, &p);
81f5049b 2409 if (r < 0)
3acc84eb
FB		 2410 return log_error_errno(r, "Failed to create relative path: %m");
2411
2412 if (symlink(p, "/dev/console") < 0)
2413 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
a258bf26 2414
3acc84eb 2415 return 0;
e58a1277
LP		 2416}
2417
8e5430c4
LP		 2418static int setup_keyring(void) {
2419 key_serial_t keyring;
2420
6b000af4
LP		 2421 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2422 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2423 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2424 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2425 * into the container. */
8e5430c4
LP		 2426
2427 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2428 if (keyring == -1) {
2429 if (errno == ENOSYS)
2430 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
065b4774 2431 else if (ERRNO_IS_PRIVILEGE(errno))
8e5430c4
LP		 2432 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2433 else
2434 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2435 }
2436
2437 return 0;
2438}
2439
3652872a
LP		 2440static int setup_credentials(const char *root) {
2441 const char *q;
2442 int r;
2443
2444 if (arg_n_credentials <= 0)
2445 return 0;
2446
2447 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2448 if (r < 0)
2449 return log_error_errno(r, "Failed to create /run/host: %m");
2450
2451 r = userns_mkdir(root, "/run/host/credentials", 0700, 0, 0);
2452 if (r < 0)
2453 return log_error_errno(r, "Failed to create /run/host/credentials: %m");
2454
2455 q = prefix_roota(root, "/run/host/credentials");
511a8cfe 2456 r = mount_nofollow_verbose(LOG_ERR, NULL, q, "ramfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0700");
3652872a
LP		 2457 if (r < 0)
2458 return r;
2459
2460 for (size_t i = 0; i < arg_n_credentials; i++) {
2461 _cleanup_free_ char *j = NULL;
2462 _cleanup_close_ int fd = -1;
2463
2464 j = path_join(q, arg_credentials[i].id);
2465 if (!j)
2466 return log_oom();
2467
2468 fd = open(j, O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC|O_NOFOLLOW, 0600);
2469 if (fd < 0)
2470 return log_error_errno(errno, "Failed to create credential file %s: %m", j);
2471
2472 r = loop_write(fd, arg_credentials[i].data, arg_credentials[i].size, /* do_poll= */ false);
2473 if (r < 0)
2474 return log_error_errno(r, "Failed to write credential to file %s: %m", j);
2475
2476 if (fchmod(fd, 0400) < 0)
2477 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", j);
2478
2479 if (arg_userns_mode != USER_NAMESPACE_NO) {
2480 if (fchown(fd, arg_uid_shift, arg_uid_shift) < 0)
2481 return log_error_errno(errno, "Failed to adjust ownership of %s: %m", j);
2482 }
2483 }
2484
2485 if (chmod(q, 0500) < 0)
2486 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", q);
2487
2488 r = userns_lchown(q, 0, 0);
2489 if (r < 0)
2490 return r;
2491
2492 /* Make both mount and superblock read-only now */
511a8cfe 2493 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
3652872a
LP		 2494 if (r < 0)
2495 return r;
2496
511a8cfe 2497 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0500");
3652872a
LP		 2498}
2499
1e4f1671 2500static int setup_kmsg(int kmsg_socket) {
9ec5a93c
LP		 2501 _cleanup_(unlink_and_freep) char *from = NULL;
2502 _cleanup_free_ char *fifo = NULL;
2503 _cleanup_close_ int fd = -1;
9ec5a93c 2504 int r;
e58a1277 2505
e58a1277 2506 assert(kmsg_socket >= 0);
a258bf26 2507
52f05ef2 2508 BLOCK_WITH_UMASK(0000);
a258bf26 2509
1eacc470 2510 /* We create the kmsg FIFO as as temporary file in /run, but immediately delete it after bind mounting it to
9ec5a93c
LP		 2511 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2512 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2513 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2514
1eacc470 2515 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
9ec5a93c
LP		 2516 if (r < 0)
2517 return log_error_errno(r, "Failed to generate kmsg path: %m");
e58a1277 2518
9ec5a93c 2519 if (mkfifo(fifo, 0600) < 0)
03cfe0d5 2520 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
9ec5a93c
LP		 2521
2522 from = TAKE_PTR(fifo);
9ec5a93c 2523
511a8cfe 2524 r = mount_nofollow_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
60e76d48
ZJS		 2525 if (r < 0)
2526 return r;
e58a1277 2527
669fc4e5 2528 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
4a62c710
MS		 2529 if (fd < 0)
2530 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 2531
9ec5a93c 2532 /* Store away the fd in the socket, so that it stays open as long as we run the child */
3ee897d6 2533 r = send_one_fd(kmsg_socket, fd, 0);
d9603714
DH		 2534 if (r < 0)
2535 return log_error_errno(r, "Failed to send FIFO fd: %m");
a258bf26 2536
25ea79fe 2537 return 0;
88213476
LP		 2538}
2539
761cf19d 2540struct ExposeArgs {
deff68e7
FW		 2541 union in_addr_union address4;
2542 union in_addr_union address6;
761cf19d
FW		 2543 struct FirewallContext *fw_ctx;
2544};
2545
1c4baffc 2546static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
761cf19d 2547 struct ExposeArgs *args = userdata;
6d0b55c2
LP		 2548
2549 assert(rtnl);
2550 assert(m);
761cf19d 2551 assert(args);
6d0b55c2 2552
fb9044cb
LP		 2553 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
2554 (void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
6d0b55c2
LP		 2555 return 0;
2556}
2557
3a74cea5 2558static int setup_hostname(void) {
c818eef1 2559 int r;
3a74cea5 2560
0c582db0 2561 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
eb91eb18
LP		 2562 return 0;
2563
c818eef1
LP		 2564 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2565 if (r < 0)
2566 return log_error_errno(r, "Failed to set hostname: %m");
3a74cea5 2567
7027ff61 2568 return 0;
3a74cea5
LP		 2569}
2570
57fb9fb5 2571static int setup_journal(const char *directory) {
0f5e1382 2572 _cleanup_free_ char *d = NULL;
5980d463 2573 const char *p, *q;
b2238e38 2574 sd_id128_t this_id;
8054d749 2575 bool try;
57fb9fb5
LP		 2576 int r;
2577
df9a75e4
LP		 2578 /* Don't link journals in ephemeral mode */
2579 if (arg_ephemeral)
2580 return 0;
2581
8054d749
LP		 2582 if (arg_link_journal == LINK_NO)
2583 return 0;
2584
2585 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2586
4d680aee 2587 r = sd_id128_get_machine(&this_id);
f647962d
MS		 2588 if (r < 0)
2589 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee 2590
e01ff70a 2591 if (sd_id128_equal(arg_uuid, this_id)) {
8054d749 2592 log_full(try ? LOG_WARNING : LOG_ERR,
85b55869 2593 "Host and machine ids are equal (%s): refusing to link journals", SD_ID128_TO_STRING(arg_uuid));
8054d749 2594 if (try)
4d680aee 2595 return 0;
df9a75e4 2596 return -EEXIST;
4d680aee
ZJS		 2597 }
2598
369ca6da
ZJS		 2599 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2600 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2601 if (r < 0) {
2602 bool ignore = r == -EROFS && try;
2603 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2604 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2605 return ignore ? 0 : r;
2606 }
2607 }
03cfe0d5 2608
85b55869 2609 p = strjoina("/var/log/journal/", SD_ID128_TO_STRING(arg_uuid));
03cfe0d5 2610 q = prefix_roota(directory, p);
27407a01 2611
e1873695 2612 if (path_is_mount_point(p, NULL, 0) > 0) {
8054d749
LP		 2613 if (try)
2614 return 0;
27407a01 2615
baaa35ad
ZJS		 2616 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2617 "%s: already a mount point, refusing to use for journal", p);
57fb9fb5
LP		 2618 }
2619
e1873695 2620 if (path_is_mount_point(q, NULL, 0) > 0) {
8054d749
LP		 2621 if (try)
2622 return 0;
57fb9fb5 2623
baaa35ad
ZJS		 2624 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2625 "%s: already a mount point, refusing to use for journal", q);
57fb9fb5
LP		 2626 }
2627
2628 r = readlink_and_make_absolute(p, &d);
2629 if (r >= 0) {
3742095b 2630 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
57fb9fb5
LP		 2631 path_equal(d, q)) {
2632
03cfe0d5 2633 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2634 if (r < 0)
709f6e46 2635 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2636 return 0;
57fb9fb5
LP		 2637 }
2638
4a62c710
MS		 2639 if (unlink(p) < 0)
2640 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 2641 } else if (r == -EINVAL) {
2642
2643 if (arg_link_journal == LINK_GUEST &&
2644 rmdir(p) < 0) {
2645
27407a01
ZJS		 2646 if (errno == ENOTDIR) {
2647 log_error("%s already exists and is neither a symlink nor a directory", p);
2648 return r;
4314d33f
MS		 2649 } else
2650 return log_error_errno(errno, "Failed to remove %s: %m", p);
57fb9fb5 2651 }
4314d33f
MS		 2652 } else if (r != -ENOENT)
2653 return log_error_errno(r, "readlink(%s) failed: %m", p);
57fb9fb5
LP		 2654
2655 if (arg_link_journal == LINK_GUEST) {
2656
2657 if (symlink(q, p) < 0) {
8054d749 2658 if (try) {
56f64d95 2659 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90 2660 return 0;
4314d33f
MS		 2661 } else
2662 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
57fb9fb5
LP		 2663 }
2664
03cfe0d5 2665 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2666 if (r < 0)
709f6e46 2667 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2668 return 0;
57fb9fb5
LP		 2669 }
2670
2671 if (arg_link_journal == LINK_HOST) {
ccddd104 2672 /* don't create parents here — if the host doesn't have
574edc90 2673 * permanent journal set up, don't force it here */
ba8e6c4d 2674
3f692e2e 2675 r = RET_NERRNO(mkdir(p, 0755));
dae8b82e 2676 if (r < 0 && r != -EEXIST) {
8054d749 2677 if (try) {
dae8b82e 2678 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
574edc90 2679 return 0;
4314d33f 2680 } else
dae8b82e 2681 return log_error_errno(r, "Failed to create %s: %m", p);
57fb9fb5
LP		 2682 }
2683
27407a01
ZJS		 2684 } else if (access(p, F_OK) < 0)
2685 return 0;
57fb9fb5 2686
db55bbf2 2687 if (dir_is_empty(q, /* ignore_hidden_or_backup= */ false) == 0)
cdb2b9d0
LP		 2688 log_warning("%s is not empty, proceeding anyway.", q);
2689
03cfe0d5 2690 r = userns_mkdir(directory, p, 0755, 0, 0);
709f6e46
MS		 2691 if (r < 0)
2692 return log_error_errno(r, "Failed to create %s: %m", q);
57fb9fb5 2693
511a8cfe 2694 r = mount_nofollow_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
60e76d48 2695 if (r < 0)
4a62c710 2696 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 2697
27407a01 2698 return 0;
57fb9fb5
LP		 2699}
2700
de40a303
LP		 2701static int drop_capabilities(uid_t uid) {
2702 CapabilityQuintet q;
2703
2704 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2705 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2706 * arg_caps_retain. */
2707
2708 if (capability_quintet_is_set(&arg_full_capabilities)) {
2709 q = arg_full_capabilities;
2710
f5fbe71d 2711 if (q.bounding == UINT64_MAX)
de40a303
LP		 2712 q.bounding = uid == 0 ? arg_caps_retain : 0;
2713
f5fbe71d 2714 if (q.effective == UINT64_MAX)
de40a303
LP		 2715 q.effective = uid == 0 ? q.bounding : 0;
2716
f5fbe71d 2717 if (q.inheritable == UINT64_MAX)
88fc9c9b 2718 q.inheritable = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2719
f5fbe71d 2720 if (q.permitted == UINT64_MAX)
88fc9c9b 2721 q.permitted = uid == 0 ? q.bounding : arg_caps_ambient;
de40a303 2722
f5fbe71d 2723 if (q.ambient == UINT64_MAX && ambient_capabilities_supported())
88fc9c9b 2724 q.ambient = arg_caps_ambient;
f66ad460
AZ		 2725
2726 if (capability_quintet_mangle(&q))
2727 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2728
2729 } else {
de40a303
LP		 2730 q = (CapabilityQuintet) {
2731 .bounding = arg_caps_retain,
2732 .effective = uid == 0 ? arg_caps_retain : 0,
88fc9c9b
TH		 2733 .inheritable = uid == 0 ? arg_caps_retain : arg_caps_ambient,
2734 .permitted = uid == 0 ? arg_caps_retain : arg_caps_ambient,
f5fbe71d 2735 .ambient = ambient_capabilities_supported() ? arg_caps_ambient : UINT64_MAX,
de40a303
LP		 2736 };
2737
f66ad460
AZ		 2738 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2739 * in order to maintain the same behavior as systemd < 242. */
2740 if (capability_quintet_mangle(&q))
0ccdaa79
JT		 2741 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2742 "Some capabilities will not be set because they are not in the current bounding set.");
f66ad460
AZ		 2743
2744 }
2745
de40a303 2746 return capability_quintet_enforce(&q);
88213476
LP		 2747}
2748
db999e0f
LP		 2749static int reset_audit_loginuid(void) {
2750 _cleanup_free_ char *p = NULL;
2751 int r;
2752
0c582db0 2753 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
db999e0f
LP		 2754 return 0;
2755
2756 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 2757 if (r == -ENOENT)
db999e0f 2758 return 0;
f647962d
MS		 2759 if (r < 0)
2760 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 2761
2762 /* Already reset? */
2763 if (streq(p, "4294967295"))
2764 return 0;
2765
57512c89 2766 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
db999e0f 2767 if (r < 0) {
10a87006
LP		 2768 log_error_errno(r,
2769 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2770 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2771 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2772 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2773 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 2774
db999e0f 2775 sleep(5);
77b6e194 2776 }
db999e0f
LP		 2777
2778 return 0;
77b6e194
LP		 2779}
2780
785890ac
LP		 2781static int setup_propagate(const char *root) {
2782 const char *p, *q;
709f6e46 2783 int r;
785890ac
LP		 2784
2785 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2786 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 2787 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 2788 (void) mkdir_p(p, 0600);
2789
5a27b395 2790 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
709f6e46 2791 if (r < 0)
5a27b395 2792 return log_error_errno(r, "Failed to create /run/host: %m");
03cfe0d5 2793
5a27b395 2794 r = userns_mkdir(root, "/run/host/incoming", 0600, 0, 0);
709f6e46 2795 if (r < 0)
5a27b395 2796 return log_error_errno(r, "Failed to create /run/host/incoming: %m");
03cfe0d5 2797
5a27b395 2798 q = prefix_roota(root, "/run/host/incoming");
511a8cfe 2799 r = mount_nofollow_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2800 if (r < 0)
2801 return r;
785890ac 2802
511a8cfe 2803 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
60e76d48
ZJS		 2804 if (r < 0)
2805 return r;
785890ac 2806
5a27b395 2807 /* machined will MS_MOVE into that directory, and that's only supported for non-shared mounts. */
511a8cfe 2808 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_SLAVE, NULL);
785890ac
LP		 2809}
2810
317feb4d 2811static int setup_machine_id(const char *directory) {
691675ba
LP		 2812 const char *etc_machine_id;
2813 sd_id128_t id;
3bbaff3e 2814 int r;
e01ff70a 2815
317feb4d
LP		 2816 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2817 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2818 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2819 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2820 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2821 * container behaves nicely). */
2822
e01ff70a
MS		 2823 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2824
c5fbeedb 2825 r = id128_read(etc_machine_id, ID128_PLAIN_OR_UNINIT, &id);
317feb4d
LP		 2826 if (r < 0) {
2827 if (!IN_SET(r, -ENOENT, -ENOMEDIUM)) /* If the file is missing or empty, we don't mind */
2828 return log_error_errno(r, "Failed to read machine ID from container image: %m");
691675ba 2829
317feb4d
LP		 2830 if (sd_id128_is_null(arg_uuid)) {
2831 r = sd_id128_randomize(&arg_uuid);
2832 if (r < 0)
2833 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2834 }
2835 } else {
baaa35ad
ZJS		 2836 if (sd_id128_is_null(id))
2837 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2838 "Machine ID in container image is zero, refusing.");
e01ff70a 2839
317feb4d
LP		 2840 arg_uuid = id;
2841 }
691675ba 2842
e01ff70a
MS		 2843 return 0;
2844}
2845
7336138e
LP		 2846static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2847 int r;
2848
2849 assert(directory);
2850
6c045a99 2851 if (arg_userns_mode == USER_NAMESPACE_NO || arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_CHOWN)
7336138e
LP		 2852 return 0;
2853
2854 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2855 if (r == -EOPNOTSUPP)
2856 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2857 if (r == -EBADE)
2858 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2859 if (r < 0)
2860 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2861 if (r == 0)
2862 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2863 else
2864 log_debug("Patched directory tree to match UID/GID range.");
2865
2866 return r;
2867}
2868
113cea80 2869/*
6d416b9c
LS		 2870 * Return values:
2871 * < 0 : wait_for_terminate() failed to get the state of the
2872 * container, the container was terminated by a signal, or
2873 * failed for an unknown reason. No change is made to the
2874 * container argument.
2875 * > 0 : The program executed in the container terminated with an
2876 * error. The exit code of the program executed in the
919699ec
LP		 2877 * container is returned. The container argument has been set
2878 * to CONTAINER_TERMINATED.
6d416b9c
LS		 2879 * 0 : The container is being rebooted, has been shut down or exited
2880 * successfully. The container argument has been set to either
2881 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 2882 *
6d416b9c
LS		 2883 * That is, success is indicated by a return value of zero, and an
2884 * error is indicated by a non-zero value.
113cea80
DH		 2885 */
2886static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 2887 siginfo_t status;
919699ec 2888 int r;
113cea80
DH		 2889
2890 r = wait_for_terminate(pid, &status);
f647962d
MS		 2891 if (r < 0)
2892 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 2893
2894 switch (status.si_code) {
fddbb89c 2895
113cea80 2896 case CLD_EXITED:
b5a2179b 2897 if (status.si_status == 0)
919699ec 2898 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
b5a2179b 2899 else
919699ec 2900 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 2901
919699ec
LP		 2902 *container = CONTAINER_TERMINATED;
2903 return status.si_status;
113cea80
DH		 2904
2905 case CLD_KILLED:
2906 if (status.si_status == SIGINT) {
919699ec 2907 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 2908 *container = CONTAINER_TERMINATED;
919699ec
LP		 2909 return 0;
2910
113cea80 2911 } else if (status.si_status == SIGHUP) {
919699ec 2912 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 2913 *container = CONTAINER_REBOOTED;
919699ec 2914 return 0;
113cea80 2915 }
919699ec 2916
4831981d 2917 _fallthrough_;
113cea80 2918 case CLD_DUMPED:
baaa35ad
ZJS		 2919 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2920 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
113cea80
DH		 2921
2922 default:
baaa35ad
ZJS		 2923 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2924 "Container %s failed due to unknown reason.", arg_machine);
113cea80 2925 }
113cea80
DH		 2926}
2927
023fb90b
LP		 2928static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2929 pid_t pid;
2930
4a0b58c4 2931 pid = PTR_TO_PID(userdata);
023fb90b 2932 if (pid > 0) {
c6c8f6e2 2933 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 2934 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2935 sd_event_source_set_userdata(s, NULL);
2936 return 0;
2937 }
2938 }
2939
2940 sd_event_exit(sd_event_source_get_event(s), 0);
2941 return 0;
2942}
2943
6916b164 2944static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
abdb9b08
LP		 2945 pid_t pid;
2946
2947 assert(s);
2948 assert(ssi);
2949
2950 pid = PTR_TO_PID(userdata);
2951
6916b164
AU		 2952 for (;;) {
2953 siginfo_t si = {};
abdb9b08 2954
6916b164
AU		 2955 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2956 return log_error_errno(errno, "Failed to waitid(): %m");
2957 if (si.si_pid == 0) /* No pending children. */
2958 break;
abdb9b08 2959 if (si.si_pid == pid) {
6916b164
AU		 2960 /* The main process we care for has exited. Return from
2961 * signal handler but leave the zombie. */
2962 sd_event_exit(sd_event_source_get_event(s), 0);
2963 break;
2964 }
abdb9b08 2965
6916b164
AU		 2966 /* Reap all other children. */
2967 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2968 }
2969
2970 return 0;
2971}
2972
abdb9b08
LP		 2973static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2974 pid_t pid;
2975
2976 assert(m);
2977
2978 pid = PTR_TO_PID(userdata);
2979
2980 if (arg_kill_signal > 0) {
2981 log_info("Container termination requested. Attempting to halt container.");
2982 (void) kill(pid, arg_kill_signal);
2983 } else {
2984 log_info("Container termination requested. Exiting.");
2985 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
2986 }
2987
2988 return 0;
2989}
2990
ec16945e 2991static int determine_names(void) {
1b9cebf6 2992 int r;
ec16945e 2993
c1521918
LP		 2994 if (arg_template && !arg_directory && arg_machine) {
2995
2996 /* If --template= was specified then we should not
2997 * search for a machine, but instead create a new one
2998 * in /var/lib/machine. */
2999
657ee2d8 3000 arg_directory = path_join("/var/lib/machines", arg_machine);
c1521918
LP		 3001 if (!arg_directory)
3002 return log_oom();
3003 }
3004
ec16945e 3005 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 3006 if (arg_machine) {
3007 _cleanup_(image_unrefp) Image *i = NULL;
3008
d577d4a4 3009 r = image_find(IMAGE_MACHINE, arg_machine, NULL, &i);
3a6ce860
LP		 3010 if (r == -ENOENT)
3011 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
1b9cebf6
LP		 3012 if (r < 0)
3013 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
1b9cebf6 3014
eb38edce 3015 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
0f03c2a4 3016 r = free_and_strdup(&arg_image, i->path);
1b9cebf6 3017 else
0f03c2a4 3018 r = free_and_strdup(&arg_directory, i->path);
1b9cebf6 3019 if (r < 0)
0f3be6ca 3020 return log_oom();
1b9cebf6 3021
aee327b8
LP		 3022 if (!arg_ephemeral)
3023 arg_read_only = arg_read_only || i->read_only;
d7249575
LP		 3024 } else {
3025 r = safe_getcwd(&arg_directory);
3026 if (r < 0)
3027 return log_error_errno(r, "Failed to determine current directory: %m");
3028 }
ec16945e 3029
c6147113
LP		 3030 if (!arg_directory && !arg_image)
3031 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
ec16945e
LP		 3032 }
3033
3034 if (!arg_machine) {
b9ba4dab
LP		 3035 if (arg_directory && path_equal(arg_directory, "/"))
3036 arg_machine = gethostname_malloc();
e9b88a6d
LP		 3037 else if (arg_image) {
3038 char *e;
4827ab48 3039
e9b88a6d 3040 arg_machine = strdup(basename(arg_image));
4827ab48 3041
e9b88a6d
LP		 3042 /* Truncate suffix if there is one */
3043 e = endswith(arg_machine, ".raw");
3044 if (e)
3045 *e = 0;
3046 } else
3047 arg_machine = strdup(basename(arg_directory));
ec16945e
LP		 3048 if (!arg_machine)
3049 return log_oom();
3050
ae691c1d 3051 hostname_cleanup(arg_machine);
52ef5dd7 3052 if (!hostname_is_valid(arg_machine, 0))
c6147113 3053 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
b9ba4dab 3054
3603f151
LB		 3055 /* Copy the machine name before the random suffix is added below, otherwise we won't be able
3056 * to match fixed config file names. */
3057 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3058 if (!arg_settings_filename)
3059 return log_oom();
3060
e9b88a6d
LP		 3061 /* Add a random suffix when this is an ephemeral machine, so that we can run many
3062 * instances at once without manually having to specify -M each time. */
3063 if (arg_ephemeral)
3064 if (strextendf(&arg_machine, "-%016" PRIx64, random_u64()) < 0)
b9ba4dab 3065 return log_oom();
3603f151
LB		 3066 } else {
3067 arg_settings_filename = strjoin(arg_machine, ".nspawn");
3068 if (!arg_settings_filename)
3069 return log_oom();
ec16945e
LP		 3070 }
3071
3072 return 0;
3073}
3074
8d4aa2bb 3075static int chase_symlinks_and_update(char **p, unsigned flags) {
3f342ec4
LP		 3076 char *chased;
3077 int r;
3078
3079 assert(p);
3080
3081 if (!*p)
3082 return 0;
3083
a5648b80 3084 r = chase_symlinks(*p, NULL, flags, &chased, NULL);
3f342ec4
LP		 3085 if (r < 0)
3086 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
3087
a5648b80 3088 return free_and_replace(*p, chased);
3f342ec4
LP		 3089}
3090
03cfe0d5 3091static int determine_uid_shift(const char *directory) {
6dac160c 3092
0de7acce 3093 if (arg_userns_mode == USER_NAMESPACE_NO) {
03cfe0d5 3094 arg_uid_shift = 0;
6dac160c 3095 return 0;
03cfe0d5 3096 }
6dac160c
LP		 3097
3098 if (arg_uid_shift == UID_INVALID) {
3099 struct stat st;
3100
993da6d4
LP		 3101 /* Read the UID shift off the image. Maybe we can reuse this to avoid chowning. */
3102
3103 if (stat(directory, &st) < 0)
03cfe0d5 3104 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 3105
3106 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
3107
baaa35ad
ZJS		 3108 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
3109 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3110 "UID and GID base of %s don't match.", directory);
6dac160c
LP		 3111
3112 arg_uid_range = UINT32_C(0x10000);
f61c7f88
LP		 3113
3114 if (arg_uid_shift != 0) {
3115 /* If the image is shifted already, then we'll fall back to classic chowning, for
3116 * compatibility (and simplicity), or refuse if mapping is explicitly requested. */
3117
3118 if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_AUTO) {
3119 log_debug("UID base of %s is non-zero, not using UID mapping.", directory);
3120 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3121 } else if (arg_userns_ownership == USER_NAMESPACE_OWNERSHIP_MAP)
3122 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3123 "UID base of %s is not zero, UID mapping not supported.", directory);
3124 }
6dac160c
LP		 3125 }
3126
58e13de5
LP		 3127 if (!userns_shift_range_valid(arg_uid_shift, arg_uid_range))
3128 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID base too high for UID range.");
6dac160c 3129
6dac160c
LP		 3130 return 0;
3131}
3132
de40a303
LP		 3133static unsigned long effective_clone_ns_flags(void) {
3134 unsigned long flags = arg_clone_ns_flags;
3135
3136 if (arg_private_network)
3137 flags |= CLONE_NEWNET;
3138 if (arg_use_cgns)
3139 flags |= CLONE_NEWCGROUP;
3140 if (arg_userns_mode != USER_NAMESPACE_NO)
3141 flags |= CLONE_NEWUSER;
3142
3143 return flags;
3144}
3145
3146static int patch_sysctl(void) {
3147
3148 /* This table is inspired by runc's sysctl() function */
3149 static const struct {
3150 const char *key;
3151 bool prefix;
3152 unsigned long clone_flags;
3153 } safe_sysctl[] = {
3154 { "kernel.hostname", false, CLONE_NEWUTS },
3155 { "kernel.domainname", false, CLONE_NEWUTS },
3156 { "kernel.msgmax", false, CLONE_NEWIPC },
3157 { "kernel.msgmnb", false, CLONE_NEWIPC },
3158 { "kernel.msgmni", false, CLONE_NEWIPC },
3159 { "kernel.sem", false, CLONE_NEWIPC },
3160 { "kernel.shmall", false, CLONE_NEWIPC },
3161 { "kernel.shmmax", false, CLONE_NEWIPC },
3162 { "kernel.shmmni", false, CLONE_NEWIPC },
3163 { "fs.mqueue.", true, CLONE_NEWIPC },
3164 { "net.", true, CLONE_NEWNET },
3165 };
3166
3167 unsigned long flags;
de40a303
LP		 3168 int r;
3169
3170 flags = effective_clone_ns_flags();
3171
3172 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
3173 bool good = false;
3174 size_t i;
3175
3176 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
3177
3178 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
3179 continue;
3180
3181 if (safe_sysctl[i].prefix)
3182 good = startswith(*k, safe_sysctl[i].key);
3183 else
3184 good = streq(*k, safe_sysctl[i].key);
3185
3186 if (good)
3187 break;
3188 }
3189
c6147113
LP		 3190 if (!good)
3191 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
de40a303
LP		 3192
3193 r = sysctl_write(*k, *v);
3194 if (r < 0)
3195 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
3196 }
3197
3198 return 0;
3199}
3200
03cfe0d5
LP		 3201static int inner_child(
3202 Barrier *barrier,
3203 const char *directory,
3204 bool secondary,
3205 int kmsg_socket,
3206 int rtnl_socket,
3acc84eb 3207 int master_pty_socket,
e1bb4b0d
LB		 3208 FDSet *fds,
3209 char **os_release_pairs) {
69c79d3c 3210
03cfe0d5 3211 _cleanup_free_ char *home = NULL;
88614c8a 3212 size_t n_env = 1;
4ab3d29f
ZJS		 3213 char *envp[] = {
3214 (char*) "PATH=" DEFAULT_PATH_COMPAT,
6aadfa4c 3215 NULL, /* container */
03cfe0d5
LP		 3216 NULL, /* TERM */
3217 NULL, /* HOME */
3218 NULL, /* USER */
3219 NULL, /* LOGNAME */
3220 NULL, /* container_uuid */
3221 NULL, /* LISTEN_FDS */
3222 NULL, /* LISTEN_PID */
9c1e04d0 3223 NULL, /* NOTIFY_SOCKET */
3652872a 3224 NULL, /* CREDENTIALS_DIRECTORY */
b626f695 3225 NULL, /* LANG */
03cfe0d5
LP		 3226 NULL
3227 };
1a68e1e5 3228 const char *exec_target;
2371271c 3229 _cleanup_strv_free_ char **env_use = NULL;
de40a303 3230 int r, which_failed;
88213476 3231
b37469d7
LP		 3232 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
3233 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
3234 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
3235 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
3236 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
3237 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
3238 * namespace.
3239 *
3240 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
3241 * unshare(). See below. */
3242
03cfe0d5
LP		 3243 assert(barrier);
3244 assert(directory);
3245 assert(kmsg_socket >= 0);
88213476 3246
de40a303
LP		 3247 log_debug("Inner child is initializing.");
3248
0de7acce 3249 if (arg_userns_mode != USER_NAMESPACE_NO) {
03cfe0d5
LP		 3250 /* Tell the parent, that it now can write the UID map. */
3251 (void) barrier_place(barrier); /* #1 */
7027ff61 3252
03cfe0d5 3253 /* Wait until the parent wrote the UID map */
baaa35ad 3254 if (!barrier_place_and_sync(barrier)) /* #2 */
2a2e78e9 3255 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
88213476 3256
2a2e78e9
LP		 3257 /* Become the new root user inside our namespace */
3258 r = reset_uid_gid();
3259 if (r < 0)
3260 return log_error_errno(r, "Couldn't become new root: %m");
3261
3262 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
3263 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
3264 * propagation, but simply create new peer groups for all our mounts). */
511a8cfe 3265 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
2a2e78e9
LP		 3266 if (r < 0)
3267 return r;
3268 }
6d66bd3b 3269
0de7acce 3270 r = mount_all(NULL,
4f086aab 3271 arg_mount_settings | MOUNT_IN_USERNS,
0de7acce 3272 arg_uid_shift,
0de7acce 3273 arg_selinux_apifs_context);
03cfe0d5
LP		 3274 if (r < 0)
3275 return r;
3276
04413780
ZJS		 3277 if (!arg_network_namespace_path && arg_private_network) {
3278 r = unshare(CLONE_NEWNET);
3279 if (r < 0)
3280 return log_error_errno(errno, "Failed to unshare network namespace: %m");
75116558
PS		 3281
3282 /* Tell the parent that it can setup network interfaces. */
3283 (void) barrier_place(barrier); /* #3 */
04413780
ZJS		 3284 }
3285
4f086aab 3286 r = mount_sysfs(NULL, arg_mount_settings);
d8fc6a00
LP		 3287 if (r < 0)
3288 return r;
3289
03cfe0d5
LP		 3290 /* Wait until we are cgroup-ified, so that we
3291 * can mount the right cgroup path writable */
baaa35ad
ZJS		 3292 if (!barrier_place_and_sync(barrier)) /* #4 */
3293 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3294 "Parent died too early");
88213476 3295
489fae52 3296 if (arg_use_cgns) {
0996ef00
CB		 3297 r = unshare(CLONE_NEWCGROUP);
3298 if (r < 0)
04413780 3299 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
0996ef00
CB		 3300 r = mount_cgroups(
3301 "",
3302 arg_unified_cgroup_hierarchy,
3303 arg_userns_mode != USER_NAMESPACE_NO,
3304 arg_uid_shift,
3305 arg_uid_range,
5a8ff0e6 3306 arg_selinux_apifs_context,
ada54120 3307 true);
1433e0f2 3308 } else
0996ef00 3309 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
1433e0f2
LP		 3310 if (r < 0)
3311 return r;
ec16945e 3312
1e4f1671 3313 r = setup_boot_id();
03cfe0d5
LP		 3314 if (r < 0)
3315 return r;
ec16945e 3316
1e4f1671 3317 r = setup_kmsg(kmsg_socket);
03cfe0d5
LP		 3318 if (r < 0)
3319 return r;
3320 kmsg_socket = safe_close(kmsg_socket);
ec16945e 3321
de40a303
LP		 3322 r = mount_custom(
3323 "/",
3324 arg_custom_mounts,
3325 arg_n_custom_mounts,
de40a303 3326 0,
c0c8f718 3327 0,
de40a303 3328 arg_selinux_apifs_context,
5f0a6347 3329 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
de40a303
LP		 3330 if (r < 0)
3331 return r;
3332
03cfe0d5
LP		 3333 if (setsid() < 0)
3334 return log_error_errno(errno, "setsid() failed: %m");
3335
3336 if (arg_private_network)
df883de9 3337 (void) loopback_setup();
03cfe0d5 3338
7a8f6325
LP		 3339 if (arg_expose_ports) {
3340 r = expose_port_send_rtnl(rtnl_socket);
3341 if (r < 0)
3342 return r;
3343 rtnl_socket = safe_close(rtnl_socket);
3344 }
03cfe0d5 3345
3acc84eb 3346 if (arg_console_mode != CONSOLE_PIPE) {
cd132992 3347 _cleanup_close_ int master = -1;
3acc84eb
FB		 3348 _cleanup_free_ char *console = NULL;
3349
3350 /* Allocate a pty and make it available as /dev/console. */
dc98caea 3351 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3acc84eb 3352 if (master < 0)
dc98caea 3353 return log_error_errno(master, "Failed to allocate a pty: %m");
3acc84eb
FB		 3354
3355 r = setup_dev_console(console);
3356 if (r < 0)
105a1a36 3357 return log_error_errno(r, "Failed to set up /dev/console: %m");
3acc84eb
FB		 3358
3359 r = send_one_fd(master_pty_socket, master, 0);
3360 if (r < 0)
3361 return log_error_errno(r, "Failed to send master fd: %m");
3362 master_pty_socket = safe_close(master_pty_socket);
3363
3364 r = setup_stdio_as_dev_console();
3365 if (r < 0)
3366 return r;
3367 }
3368
de40a303
LP		 3369 r = patch_sysctl();
3370 if (r < 0)
3371 return r;
3372
81f345df
LP		 3373 if (arg_oom_score_adjust_set) {
3374 r = set_oom_score_adjust(arg_oom_score_adjust);
3375 if (r < 0)
3376 return log_error_errno(r, "Failed to adjust OOM score: %m");
3377 }
3378
0985c7c4
ZJS		 3379 if (arg_cpu_set.set)
3380 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
d107bb7d
LP		 3381 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3382
c818eef1 3383 (void) setup_hostname();
03cfe0d5 3384
050f7277 3385 if (arg_personality != PERSONALITY_INVALID) {
21022b9d
LP		 3386 r = safe_personality(arg_personality);
3387 if (r < 0)
3388 return log_error_errno(r, "personality() failed: %m");
03cfe0d5 3389 } else if (secondary) {
21022b9d
LP		 3390 r = safe_personality(PER_LINUX32);
3391 if (r < 0)
3392 return log_error_errno(r, "personality() failed: %m");
03cfe0d5
LP		 3393 }
3394
de40a303
LP		 3395 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3396 if (r < 0)
3397 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3398
3399#if HAVE_SECCOMP
3400 if (arg_seccomp) {
3401
3402 if (is_seccomp_available()) {
3403
3404 r = seccomp_load(arg_seccomp);
7bc5e0b1 3405 if (ERRNO_IS_SECCOMP_FATAL(r))
de40a303
LP		 3406 return log_error_errno(r, "Failed to install seccomp filter: %m");
3407 if (r < 0)
3408 log_debug_errno(r, "Failed to install seccomp filter: %m");
3409 }
3410 } else
3411#endif
3412 {
6b000af4 3413 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
de40a303
LP		 3414 if (r < 0)
3415 return r;
3416 }
3417
4a4654e0 3418 if (arg_suppress_sync) {
20e458ae 3419#if HAVE_SECCOMP
4a4654e0
LP		 3420 r = seccomp_suppress_sync();
3421 if (r < 0)
3422 log_debug_errno(r, "Failed to install sync() suppression seccomp filter, ignoring: %m");
20e458ae 3423#else
2db32618 3424 log_debug("systemd is built without SECCOMP support. Ignoring --suppress-sync= command line option and SuppressSync= setting.");
20e458ae 3425#endif
4a4654e0
LP		 3426 }
3427
349cc4a5 3428#if HAVE_SELINUX
03cfe0d5 3429 if (arg_selinux_context)
2ed96880 3430 if (setexeccon(arg_selinux_context) < 0)
03cfe0d5
LP		 3431 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3432#endif
3433
de40a303
LP		 3434 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3435 * if we need to later on. */
3436 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3437 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3438
3439 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3462d773 3440 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids, arg_console_mode != CONSOLE_PIPE);
de40a303 3441 else
3462d773 3442 r = change_uid_gid(arg_user, arg_console_mode != CONSOLE_PIPE, &home);
03cfe0d5
LP		 3443 if (r < 0)
3444 return r;
3445
de40a303
LP		 3446 r = drop_capabilities(getuid());
3447 if (r < 0)
3448 return log_error_errno(r, "Dropping capabilities failed: %m");
3449
66edd963
LP		 3450 if (arg_no_new_privileges)
3451 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3452 return log_error_errno(errno, "Failed to disable new privileges: %m");
3453
6aadfa4c
ILG		 3454 /* LXC sets container=lxc, so follow the scheme here */
3455 envp[n_env++] = strjoina("container=", arg_container_service_name);
3456
03cfe0d5
LP		 3457 envp[n_env] = strv_find_prefix(environ, "TERM=");
3458 if (envp[n_env])
313cefa1 3459 n_env++;
03cfe0d5 3460
de40a303 3461 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f 3462 if (asprintf(envp + n_env++, "HOME=%s", home ?: "/root") < 0)
de40a303
LP		 3463 return log_oom();
3464
3465 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
4ab3d29f
ZJS		 3466 if (asprintf(envp + n_env++, "USER=%s", arg_user ?: "root") < 0 ||
3467 asprintf(envp + n_env++, "LOGNAME=%s", arg_user ? arg_user : "root") < 0)
de40a303 3468 return log_oom();
03cfe0d5 3469
3bbaff3e 3470 assert(!sd_id128_is_null(arg_uuid));
03cfe0d5 3471
b7416360 3472 if (asprintf(envp + n_env++, "container_uuid=%s", SD_ID128_TO_UUID_STRING(arg_uuid)) < 0)
e01ff70a 3473 return log_oom();
03cfe0d5
LP		 3474
3475 if (fdset_size(fds) > 0) {
3476 r = fdset_cloexec(fds, false);
3477 if (r < 0)
3478 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3479
4ab3d29f
ZJS		 3480 if ((asprintf(envp + n_env++, "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3481 (asprintf(envp + n_env++, "LISTEN_PID=1") < 0))
03cfe0d5
LP		 3482 return log_oom();
3483 }
4ab3d29f 3484 if (asprintf(envp + n_env++, "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
9c1e04d0 3485 return log_oom();
03cfe0d5 3486
3652872a
LP		 3487 if (arg_n_credentials > 0) {
3488 envp[n_env] = strdup("CREDENTIALS_DIRECTORY=/run/host/credentials");
3489 if (!envp[n_env])
3490 return log_oom();
3491 n_env++;
3492 }
3493
b626f695 3494 if (arg_start_mode != START_BOOT) {
a22f5186 3495 envp[n_env] = strdup("LANG=" SYSTEMD_NSPAWN_LOCALE);
b626f695
DDM		 3496 if (!envp[n_env])
3497 return log_oom();
3498 n_env++;
3499 }
3500
4ab3d29f 3501 env_use = strv_env_merge(envp, os_release_pairs, arg_setenv);
2371271c
TG		 3502 if (!env_use)
3503 return log_oom();
03cfe0d5
LP		 3504
3505 /* Let the parent know that we are ready and
3506 * wait until the parent is ready with the
3507 * setup, too... */
baaa35ad 3508 if (!barrier_place_and_sync(barrier)) /* #5 */
335d2ead 3509 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
03cfe0d5 3510
5f932eb9
LP		 3511 if (arg_chdir)
3512 if (chdir(arg_chdir) < 0)
3513 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3514
7732f92b 3515 if (arg_start_mode == START_PID2) {
75bf701f 3516 r = stub_pid1(arg_uuid);
7732f92b
LP		 3517 if (r < 0)
3518 return r;
3519 }
3520
335d2ead
LP		 3521 if (arg_console_mode != CONSOLE_PIPE) {
3522 /* So far our pty wasn't controlled by any process. Finally, it's time to change that, if we
3523 * are configured for that. Acquire it as controlling tty. */
3524 if (ioctl(STDIN_FILENO, TIOCSCTTY) < 0)
3525 return log_error_errno(errno, "Failed to acquire controlling TTY: %m");
3526 }
3527
de40a303
LP		 3528 log_debug("Inner child completed, invoking payload.");
3529
8ca082b4
LP		 3530 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3531 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3532 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
03cfe0d5 3533 log_close();
8ca082b4
LP		 3534 log_set_open_when_needed(true);
3535
03cfe0d5
LP		 3536 (void) fdset_close_others(fds);
3537
7732f92b 3538 if (arg_start_mode == START_BOOT) {
03cfe0d5
LP		 3539 char **a;
3540 size_t m;
3541
3542 /* Automatically search for the init system */
3543
75f32f04
ZJS		 3544 m = strv_length(arg_parameters);
3545 a = newa(char*, m + 2);
3546 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3547 a[1 + m] = NULL;
03cfe0d5 3548
a5096641
LP		 3549 FOREACH_STRING(init,
3550 "/usr/lib/systemd/systemd",
3551 "/lib/systemd/systemd",
3552 "/sbin/init") {
3553 a[0] = (char*) init;
3554 execve(a[0], a, env_use);
3555 }
ced58da7
LP		 3556
3557 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
1a68e1e5 3558 } else if (!strv_isempty(arg_parameters)) {
b6b180b7
LP		 3559 const char *dollar_path;
3560
1a68e1e5 3561 exec_target = arg_parameters[0];
b6b180b7
LP		 3562
3563 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3564 * binary. */
3565 dollar_path = strv_env_get(env_use, "PATH");
3566 if (dollar_path) {
6f646e01 3567 if (setenv("PATH", dollar_path, 1) < 0)
b6b180b7
LP		 3568 return log_error_errno(errno, "Failed to update $PATH: %m");
3569 }
3570
f757855e 3571 execvpe(arg_parameters[0], arg_parameters, env_use);
1a68e1e5 3572 } else {
5f932eb9 3573 if (!arg_chdir)
d929b0f9
ZJS		 3574 /* If we cannot change the directory, we'll end up in /, that is expected. */
3575 (void) chdir(home ?: "/root");
5f932eb9 3576
53350c7b 3577 execle(DEFAULT_USER_SHELL, "-" DEFAULT_USER_SHELL_NAME, NULL, env_use);
3578 if (!streq(DEFAULT_USER_SHELL, "/bin/bash"))
3579 execle("/bin/bash", "-bash", NULL, env_use);
3580 if (!streq(DEFAULT_USER_SHELL, "/bin/sh"))
3581 execle("/bin/sh", "-sh", NULL, env_use);
ced58da7 3582
53350c7b 3583 exec_target = DEFAULT_USER_SHELL ", /bin/bash, /bin/sh";
03cfe0d5
LP		 3584 }
3585
8ca082b4 3586 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
03cfe0d5
LP		 3587}
3588
e96ceaba 3589static int setup_notify_child(void) {
271f518f 3590 _cleanup_close_ int fd = -1;
1eb874b9 3591 static const union sockaddr_union sa = {
44ed5214
LP		 3592 .un.sun_family = AF_UNIX,
3593 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
9c1e04d0
AP		 3594 };
3595 int r;
3596
3597 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3598 if (fd < 0)
3599 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3600
3601 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
fbda85b0 3602 (void) sockaddr_un_unlink(&sa.un);
9c1e04d0 3603
9c1e04d0 3604 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
271f518f 3605 if (r < 0)
44ed5214 3606 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
9c1e04d0 3607
adc7d9f0 3608 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
271f518f 3609 if (r < 0)
adc7d9f0 3610 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
adc7d9f0 3611
2ff48e98 3612 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
271f518f 3613 if (r < 0)
2ff48e98 3614 return log_error_errno(r, "SO_PASSCRED failed: %m");
9c1e04d0 3615
271f518f 3616 return TAKE_FD(fd);
9c1e04d0
AP		 3617}
3618
03cfe0d5
LP		 3619static int outer_child(
3620 Barrier *barrier,
3621 const char *directory,
2d845785 3622 DissectedImage *dissected_image,
03cfe0d5
LP		 3623 bool secondary,
3624 int pid_socket,
e01ff70a 3625 int uuid_socket,
9c1e04d0 3626 int notify_socket,
03cfe0d5
LP		 3627 int kmsg_socket,
3628 int rtnl_socket,
825d5287 3629 int uid_shift_socket,
3acc84eb 3630 int master_pty_socket,
8199d554 3631 int unified_cgroup_hierarchy_socket,
d7bea6b6
DP		 3632 FDSet *fds,
3633 int netns_fd) {
03cfe0d5 3634
2f893044 3635 _cleanup_(bind_user_context_freep) BindUserContext *bind_user_context = NULL;
e1bb4b0d 3636 _cleanup_strv_free_ char **os_release_pairs = NULL;
bf428efb 3637 _cleanup_close_ int fd = -1;
f61c7f88 3638 bool idmap = false;
e5f10caf 3639 const char *p;
03cfe0d5
LP		 3640 pid_t pid;
3641 ssize_t l;
de40a303 3642 int r;
03cfe0d5 3643
d1d0b895
LP		 3644 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It
3645 * already has its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in
3646 * the host's CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET
3647 * namespaces. After it completed a number of initializations a second child (the "inner" one) is
3648 * forked off it, and it exits. */
b37469d7 3649
03cfe0d5
LP		 3650 assert(barrier);
3651 assert(directory);
03cfe0d5 3652 assert(pid_socket >= 0);
e01ff70a 3653 assert(uuid_socket >= 0);
9c1e04d0 3654 assert(notify_socket >= 0);
3acc84eb 3655 assert(master_pty_socket >= 0);
03cfe0d5
LP		 3656 assert(kmsg_socket >= 0);
3657
de40a303
LP		 3658 log_debug("Outer child is initializing.");
3659
e1bb4b0d
LB		 3660 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3661 if (r < 0)
3662 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3663
03cfe0d5
LP		 3664 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3665 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3666
03cfe0d5
LP		 3667 r = reset_audit_loginuid();
3668 if (r < 0)
3669 return r;
3670
2a2e78e9
LP		 3671 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3672 * mounts to the real root. */
511a8cfe 3673 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
60e76d48
ZJS		 3674 if (r < 0)
3675 return r;
03cfe0d5 3676
2d845785 3677 if (dissected_image) {
d1d0b895
LP		 3678 /* If we are operating on a disk image, then mount its root directory now, but leave out the
3679 * rest. We can read the UID shift from it if we need to. Further down we'll mount the rest,
3680 * but then with the uid shift known. That way we can mount VFAT file systems shifted to the
3681 * right place right away. This makes sure ESP partitions and userns are compatible. */
2d3a5a73 3682
af187ab2 3683 r = dissected_image_mount_and_warn(
d04faa4e
LP		 3684 dissected_image,
3685 directory,
3686 arg_uid_shift,
21b61b1d 3687 arg_uid_range,
d04faa4e
LP		 3688 DISSECT_IMAGE_MOUNT_ROOT_ONLY|
3689 DISSECT_IMAGE_DISCARD_ON_LOOP|
3690 DISSECT_IMAGE_USR_NO_ROOT|
c65f854a 3691 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
af187ab2 3692 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
2d845785 3693 if (r < 0)
af187ab2 3694 return r;
2d845785 3695 }
03cfe0d5 3696
391567f4
LP		 3697 r = determine_uid_shift(directory);
3698 if (r < 0)
3699 return r;
3700
0de7acce 3701 if (arg_userns_mode != USER_NAMESPACE_NO) {
0e7ac751 3702 /* Let the parent know which UID shift we read from the image */
825d5287
RM		 3703 l = send(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
3704 if (l < 0)
3705 return log_error_errno(errno, "Failed to send UID shift: %m");
baaa35ad
ZJS		 3706 if (l != sizeof(arg_uid_shift))
3707 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3708 "Short write while sending UID shift.");
0e7ac751 3709
0de7acce 3710 if (arg_userns_mode == USER_NAMESPACE_PICK) {
d1d0b895
LP		 3711 /* When we are supposed to pick the UID shift, the parent will check now whether the
3712 * UID shift we just read from the image is available. If yes, it will send the UID
3713 * shift back to us, if not it will pick a different one, and send it back to us. */
0e7ac751
LP		 3714
3715 l = recv(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
3716 if (l < 0)
3717 return log_error_errno(errno, "Failed to recv UID shift: %m");
baaa35ad
ZJS		 3718 if (l != sizeof(arg_uid_shift))
3719 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3720 "Short read while receiving UID shift.");
0e7ac751
LP		 3721 }
3722
ff6c6cc1
LP		 3723 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3724 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
825d5287
RM		 3725 }
3726
6f83d3d1
LP		 3727 if (path_equal(directory, "/")) {
3728 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3729 * place, so that we can make changes to its mount structure (for example, to implement
3730 * --volatile=) without this interfering with our ability to access files such as
3731 * /etc/localtime to copy into the container. Note that we use a fixed place for this
3732 * (instead of a temporary directory, since we are living in our own mount namspace here
7802194a 3733 * already, and thus don't need to be afraid of colliding with anyone else's mounts). */
6f83d3d1
LP		 3734 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3735
511a8cfe 3736 r = mount_nofollow_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
6f83d3d1
LP		 3737 if (r < 0)
3738 return r;
3739
3740 directory = "/run/systemd/nspawn-root";
e50cd82f 3741 }
7d0ecdd6
LP		 3742
3743 r = setup_pivot_root(
3744 directory,
3745 arg_pivot_root_new,
3746 arg_pivot_root_old);
3747 if (r < 0)
3748 return r;
3749
3750 r = setup_volatile_mode(
3751 directory,
3752 arg_volatile_mode,
7d0ecdd6 3753 arg_uid_shift,
8f1ed04a 3754 arg_selinux_apifs_context);
7d0ecdd6
LP		 3755 if (r < 0)
3756 return r;
3757
2f893044
LP		 3758 r = bind_user_prepare(
3759 directory,
3760 arg_bind_user,
3761 arg_uid_shift,
3762 arg_uid_range,
3763 &arg_custom_mounts, &arg_n_custom_mounts,
3764 &bind_user_context);
3765 if (r < 0)
3766 return r;
3767
3768 if (arg_userns_mode != USER_NAMESPACE_NO && bind_user_context) {
d1d0b895
LP		 3769 /* Send the user maps we determined to the parent, so that it installs it in our user
3770 * namespace UID map table */
2f893044
LP		 3771
3772 for (size_t i = 0; i < bind_user_context->n_data; i++) {
3773 uid_t map[] = {
3774 bind_user_context->data[i].payload_user->uid,
3775 bind_user_context->data[i].host_user->uid,
3776 (uid_t) bind_user_context->data[i].payload_group->gid,
3777 (uid_t) bind_user_context->data[i].host_group->gid,
3778 };
3779
3780 l = send(uid_shift_socket, map, sizeof(map), MSG_NOSIGNAL);
3781 if (l < 0)
3782 return log_error_errno(errno, "Failed to send user UID map: %m");
3783 if (l != sizeof(map))
3784 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3785 "Short write while sending user UID map.");
3786 }
3787 }
3788
5f0a6347
DDM		 3789 r = mount_custom(
3790 directory,
3791 arg_custom_mounts,
3792 arg_n_custom_mounts,
5f0a6347 3793 arg_uid_shift,
c0c8f718 3794 arg_uid_range,
5f0a6347
DDM		 3795 arg_selinux_apifs_context,
3796 MOUNT_ROOT_ONLY);
3797 if (r < 0)
3798 return r;
3799
5530dc87 3800 /* Make sure we always have a mount that we can move to root later on. */
14a25e1f
LP		 3801 r = make_mount_point(directory);
3802 if (r < 0)
3803 return r;
5530dc87 3804
c0c8f718
AV		 3805 if (arg_userns_mode != USER_NAMESPACE_NO &&
3806 IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
3807 arg_uid_shift != 0) {
3808
50ae2966 3809 r = remount_idmap(directory, arg_uid_shift, arg_uid_range, REMOUNT_IDMAP_HOST_ROOT);
c0c8f718
AV		 3810 if (r == -EINVAL || ERRNO_IS_NOT_SUPPORTED(r)) {
3811 /* This might fail because the kernel or file system doesn't support idmapping. We
3812 * can't really distinguish this nicely, nor do we have any guarantees about the
3813 * error codes we see, could be EOPNOTSUPP or EINVAL. */
3814 if (arg_userns_ownership != USER_NAMESPACE_OWNERSHIP_AUTO)
3815 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
3816 "ID mapped mounts are apparently not available, sorry.");
3817
3818 log_debug("ID mapped mounts are apparently not available on this kernel or for the selected file system, reverting to recursive chown()ing.");
3819 arg_userns_ownership = USER_NAMESPACE_OWNERSHIP_CHOWN;
3820 } else if (r < 0)
3821 return log_error_errno(r, "Failed to set up ID mapped mounts: %m");
3822 else {
3823 log_debug("ID mapped mounts available, making use of them.");
3824 idmap = true;
3825 }
3826 }
3827
2d3a5a73
LP		 3828 if (dissected_image) {
3829 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
d04faa4e
LP		 3830 r = dissected_image_mount(
3831 dissected_image,
3832 directory,
3833 arg_uid_shift,
21b61b1d 3834 arg_uid_range,
d04faa4e
LP		 3835 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|
3836 DISSECT_IMAGE_DISCARD_ON_LOOP|
3837 DISSECT_IMAGE_USR_NO_ROOT|
f61c7f88
LP		 3838 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK|DISSECT_IMAGE_GROWFS)|
3839 (idmap ? DISSECT_IMAGE_MOUNT_IDMAPPED : 0));
4fcb96ce
LP		 3840 if (r == -EUCLEAN)
3841 return log_error_errno(r, "File system check for image failed: %m");
2d3a5a73 3842 if (r < 0)
4fcb96ce 3843 return log_error_errno(r, "Failed to mount image file system: %m");
2d3a5a73
LP		 3844 }
3845
8199d554
LP		 3846 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3847 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3848
3849 r = detect_unified_cgroup_hierarchy_from_image(directory);
3850 if (r < 0)
3851 return r;
3852
3853 l = send(unified_cgroup_hierarchy_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
3854 if (l < 0)
3855 return log_error_errno(errno, "Failed to send cgroup mode: %m");
baaa35ad
ZJS		 3856 if (l != sizeof(arg_unified_cgroup_hierarchy))
3857 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3858 "Short write while sending cgroup mode.");
8199d554
LP		 3859
3860 unified_cgroup_hierarchy_socket = safe_close(unified_cgroup_hierarchy_socket);
3861 }
3862
d1d0b895
LP		 3863 /* Mark everything as shared so our mounts get propagated down. This is required to make new bind
3864 * mounts available in systemd services inside the container that create a new mount namespace. See
3865 * https://github.com/systemd/systemd/issues/3860 Further submounts (such as /dev) done after this
3866 * will inherit the shared propagation mode.
5f0a6347 3867 *
d1d0b895
LP		 3868 * IMPORTANT: Do not overmount the root directory anymore from now on to enable moving the root
3869 * directory mount to root later on.
5f0a6347
DDM		 3870 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3871 */
511a8cfe 3872 r = mount_nofollow_verbose(LOG_ERR, NULL, directory, NULL, MS_SHARED|MS_REC, NULL);
4ad14eff
LP		 3873 if (r < 0)
3874 return r;
3875
3876 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3877 if (r < 0)
3878 return r;
3879
03cfe0d5
LP		 3880 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3881 if (r < 0)
3882 return r;
3883
bbd407ea
DDM		 3884 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3885 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
64e82c19 3886 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
03cfe0d5
LP		 3887 if (r < 0)
3888 return log_error_errno(r, "Failed to make tree read-only: %m");
3889 }
3890
0de7acce 3891 r = mount_all(directory,
4f086aab 3892 arg_mount_settings,
0de7acce 3893 arg_uid_shift,
0de7acce 3894 arg_selinux_apifs_context);
03cfe0d5
LP		 3895 if (r < 0)
3896 return r;
3897
07fa00f9
LP		 3898 r = copy_devnodes(directory);
3899 if (r < 0)
03cfe0d5
LP		 3900 return r;
3901
de40a303
LP		 3902 r = make_extra_nodes(directory);
3903 if (r < 0)
3904 return r;
3905
3906 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
e5f10caf 3907
9fac5029 3908 p = prefix_roota(directory, "/run/host");
e5f10caf 3909 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
03cfe0d5 3910
07fa00f9
LP		 3911 r = setup_pts(directory);
3912 if (r < 0)
03cfe0d5
LP		 3913 return r;
3914
3915 r = setup_propagate(directory);
3916 if (r < 0)
3917 return r;
3918
8e5430c4
LP		 3919 r = setup_keyring();
3920 if (r < 0)
3921 return r;
3922
3652872a
LP		 3923 r = setup_credentials(directory);
3924 if (r < 0)
3925 return r;
3926
2f893044
LP		 3927 r = bind_user_setup(bind_user_context, directory);
3928 if (r < 0)
3929 return r;
3930
5c4deb9a
MJ		 3931 r = mount_custom(
3932 directory,
3933 arg_custom_mounts,
3934 arg_n_custom_mounts,
3935 arg_uid_shift,
c0c8f718 3936 arg_uid_range,
5c4deb9a
MJ		 3937 arg_selinux_apifs_context,
3938 MOUNT_NON_ROOT_ONLY);
3939 if (r < 0)
3940 return r;
3941
03cfe0d5
LP		 3942 r = setup_timezone(directory);
3943 if (r < 0)
3944 return r;
3945
3946 r = setup_resolv_conf(directory);
3947 if (r < 0)
3948 return r;
3949
e01ff70a
MS		 3950 r = setup_machine_id(directory);
3951 if (r < 0)
3952 return r;
3953
03cfe0d5
LP		 3954 r = setup_journal(directory);
3955 if (r < 0)
3956 return r;
3957
0f48ba7b
LP		 3958 /* The same stuff as the $container env var, but nicely readable for the entire payload */
3959 p = prefix_roota(directory, "/run/host/container-manager");
3960 (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE);
3961
3962 /* The same stuff as the $container_uuid env var */
3963 p = prefix_roota(directory, "/run/host/container-uuid");
3964 (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
3965
489fae52 3966 if (!arg_use_cgns) {
0996ef00
CB		 3967 r = mount_cgroups(
3968 directory,
3969 arg_unified_cgroup_hierarchy,
3970 arg_userns_mode != USER_NAMESPACE_NO,
3971 arg_uid_shift,
3972 arg_uid_range,
5a8ff0e6 3973 arg_selinux_apifs_context,
ada54120 3974 false);
0996ef00
CB		 3975 if (r < 0)
3976 return r;
3977 }
03cfe0d5
LP		 3978
3979 r = mount_move_root(directory);
3980 if (r < 0)
3981 return log_error_errno(r, "Failed to move root directory: %m");
3982
e96ceaba 3983 fd = setup_notify_child();
9c1e04d0
AP		 3984 if (fd < 0)
3985 return fd;
3986
03cfe0d5 3987 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
0c582db0 3988 arg_clone_ns_flags |
8869a0b4 3989 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
03cfe0d5
LP		 3990 if (pid < 0)
3991 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5
LP		 3992 if (pid == 0) {
3993 pid_socket = safe_close(pid_socket);
e01ff70a 3994 uuid_socket = safe_close(uuid_socket);
9c1e04d0 3995 notify_socket = safe_close(notify_socket);
825d5287 3996 uid_shift_socket = safe_close(uid_shift_socket);
03cfe0d5 3997
2a2e78e9
LP		 3998 /* The inner child has all namespaces that are requested, so that we all are owned by the
3999 * user if user namespaces are turned on. */
03cfe0d5 4000
d7bea6b6
DP		 4001 if (arg_network_namespace_path) {
4002 r = namespace_enter(-1, -1, netns_fd, -1, -1);
4003 if (r < 0)
e2d39e54 4004 return log_error_errno(r, "Failed to join network namespace: %m");
d7bea6b6
DP		 4005 }
4006
e1bb4b0d 4007 r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, master_pty_socket, fds, os_release_pairs);
03cfe0d5
LP		 4008 if (r < 0)
4009 _exit(EXIT_FAILURE);
4010
4011 _exit(EXIT_SUCCESS);
4012 }
4013
4014 l = send(pid_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
4015 if (l < 0)
4016 return log_error_errno(errno, "Failed to send PID: %m");
baaa35ad
ZJS		 4017 if (l != sizeof(pid))
4018 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4019 "Short write while sending PID.");
03cfe0d5 4020
e01ff70a
MS		 4021 l = send(uuid_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
4022 if (l < 0)
4023 return log_error_errno(errno, "Failed to send machine ID: %m");
baaa35ad
ZJS		 4024 if (l != sizeof(arg_uuid))
4025 return log_error_errno(SYNTHETIC_ERRNO(EIO),
4026 "Short write while sending machine ID.");
e01ff70a 4027
9c1e04d0
AP		 4028 l = send_one_fd(notify_socket, fd, 0);
4029 if (l < 0)
ba72801d 4030 return log_error_errno(l, "Failed to send notify fd: %m");
9c1e04d0 4031
03cfe0d5 4032 pid_socket = safe_close(pid_socket);
e01ff70a 4033 uuid_socket = safe_close(uuid_socket);
9c1e04d0 4034 notify_socket = safe_close(notify_socket);
3acc84eb 4035 master_pty_socket = safe_close(master_pty_socket);
327e26d6
KN		 4036 kmsg_socket = safe_close(kmsg_socket);
4037 rtnl_socket = safe_close(rtnl_socket);
d7bea6b6 4038 netns_fd = safe_close(netns_fd);
03cfe0d5
LP		 4039
4040 return 0;
4041}
4042
0e7ac751 4043static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
d381c8a6 4044 bool tried_hashed = false;
0e7ac751
LP		 4045 unsigned n_tries = 100;
4046 uid_t candidate;
4047 int r;
4048
4049 assert(shift);
4050 assert(ret_lock_file);
0de7acce 4051 assert(arg_userns_mode == USER_NAMESPACE_PICK);
0e7ac751
LP		 4052 assert(arg_uid_range == 0x10000U);
4053
4054 candidate = *shift;
4055
4056 (void) mkdir("/run/systemd/nspawn-uid", 0755);
4057
4058 for (;;) {
fbd0b64f 4059 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
8e766630 4060 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
0e7ac751
LP		 4061
4062 if (--n_tries <= 0)
4063 return -EBUSY;
4064
87d5e4f2 4065 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
0e7ac751
LP		 4066 goto next;
4067 if ((candidate & UINT32_C(0xFFFF)) != 0)
4068 goto next;
4069
4070 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
4071 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
4072 if (r == -EBUSY) /* Range already taken by another nspawn instance */
4073 goto next;
4074 if (r < 0)
4075 return r;
4076
4077 /* Make some superficial checks whether the range is currently known in the user database */
4078 if (getpwuid(candidate))
4079 goto next;
4080 if (getpwuid(candidate + UINT32_C(0xFFFE)))
4081 goto next;
4082 if (getgrgid(candidate))
4083 goto next;
4084 if (getgrgid(candidate + UINT32_C(0xFFFE)))
4085 goto next;
4086
4087 *ret_lock_file = lf;
4088 lf = (struct LockFile) LOCK_FILE_INIT;
4089 *shift = candidate;
4090 return 0;
4091
4092 next:
d381c8a6
LP		 4093 if (arg_machine && !tried_hashed) {
4094 /* Try to hash the base from the container name */
4095
4096 static const uint8_t hash_key[] = {
4097 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
4098 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
4099 };
4100
4101 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
4102
4103 tried_hashed = true;
4104 } else
4105 random_bytes(&candidate, sizeof(candidate));
4106
87d5e4f2 4107 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
0e7ac751
LP		 4108 candidate &= (uid_t) UINT32_C(0xFFFF0000);
4109 }
4110}
4111
2f893044
LP		 4112static int add_one_uid_map(
4113 char **p,
4114 uid_t container_uid,
4115 uid_t host_uid,
4116 uid_t range) {
4117
4118 return strextendf(p,
4119 UID_FMT " " UID_FMT " " UID_FMT "\n",
4120 container_uid, host_uid, range);
4121}
4122
4123static int make_uid_map_string(
4124 const uid_t bind_user_uid[],
4125 size_t n_bind_user_uid,
4126 size_t offset,
4127 char **ret) {
4128
4129 _cleanup_free_ char *s = NULL;
4130 uid_t previous_uid = 0;
4131 int r;
4132
4133 assert(n_bind_user_uid == 0 || bind_user_uid);
2f092762 4134 assert(IN_SET(offset, 0, 2)); /* used to switch between UID and GID map */
2f893044
LP		 4135 assert(ret);
4136
4137 /* The bind_user_uid[] array is a series of 4 uid_t values, for each --bind-user= entry one
4138 * quadruplet, consisting of host and container UID + GID. */
4139
4140 for (size_t i = 0; i < n_bind_user_uid; i++) {
05ab439a
YW		 4141 uid_t payload_uid = bind_user_uid[i*4+offset],
4142 host_uid = bind_user_uid[i*4+offset+1];
2f893044
LP		 4143
4144 assert(previous_uid <= payload_uid);
4145 assert(payload_uid < arg_uid_range);
4146
4147 /* Add a range to close the gap to previous entry */
4148 if (payload_uid > previous_uid) {
4149 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, payload_uid - previous_uid);
4150 if (r < 0)
4151 return r;
4152 }
4153
4154 /* Map this specific user */
4155 r = add_one_uid_map(&s, payload_uid, host_uid, 1);
4156 if (r < 0)
4157 return r;
4158
4159 previous_uid = payload_uid + 1;
4160 }
4161
4162 /* And add a range to close the gap to finish the range */
4163 if (arg_uid_range > previous_uid) {
4164 r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, arg_uid_range - previous_uid);
4165 if (r < 0)
4166 return r;
4167 }
4168
4169 assert(s);
4170
4171 *ret = TAKE_PTR(s);
4172 return 0;
4173}
4174
4175static int setup_uid_map(
4176 pid_t pid,
4177 const uid_t bind_user_uid[],
4178 size_t n_bind_user_uid) {
4179
4180 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1];
4181 _cleanup_free_ char *s = NULL;
03cfe0d5
LP		 4182 int r;
4183
4184 assert(pid > 1);
4185
2f893044
LP		 4186 /* Build the UID map string */
4187 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 0, &s) < 0) /* offset=0 contains the UID pair */
4188 return log_oom();
4189
03cfe0d5 4190 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
2f893044 4191 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4192 if (r < 0)
4193 return log_error_errno(r, "Failed to write UID map: %m");
4194
2f893044
LP		 4195 /* And now build the GID map string */
4196 s = mfree(s);
4197 if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 2, &s) < 0) /* offset=2 contains the GID pair */
4198 return log_oom();
4199
03cfe0d5 4200 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
2f893044 4201 r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 4202 if (r < 0)
4203 return log_error_errno(r, "Failed to write GID map: %m");
4204
4205 return 0;
4206}
4207
9c1e04d0 4208static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
9c1e04d0
AP		 4209 char buf[NOTIFY_BUFFER_MAX+1];
4210 char *p = NULL;
4211 struct iovec iovec = {
4212 .iov_base = buf,
4213 .iov_len = sizeof(buf)-1,
4214 };
fb29cdbe
LP		 4215 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
4216 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
9c1e04d0
AP		 4217 struct msghdr msghdr = {
4218 .msg_iov = &iovec,
4219 .msg_iovlen = 1,
4220 .msg_control = &control,
4221 .msg_controllen = sizeof(control),
4222 };
371d72e0 4223 struct ucred *ucred;
9c1e04d0
AP		 4224 ssize_t n;
4225 pid_t inner_child_pid;
4226 _cleanup_strv_free_ char **tags = NULL;
4bf4f50f 4227 int r;
9c1e04d0
AP		 4228
4229 assert(userdata);
4230
4231 inner_child_pid = PTR_TO_PID(userdata);
4232
4233 if (revents != EPOLLIN) {
4234 log_warning("Got unexpected poll event for notify fd.");
4235 return 0;
4236 }
4237
3691bcf3 4238 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
8add30a0
YW		 4239 if (n < 0) {
4240 if (ERRNO_IS_TRANSIENT(n))
4241 return 0;
4242 if (n == -EXFULL) {
4243 log_warning("Got message with truncated control data (too many fds sent?), ignoring.");
4244 return 0;
4245 }
3691bcf3 4246 return log_warning_errno(n, "Couldn't read notification socket: %m");
8add30a0 4247 }
9c1e04d0 4248
9c1e04d0
AP		 4249 cmsg_close_all(&msghdr);
4250
371d72e0 4251 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
9c1e04d0 4252 if (!ucred || ucred->pid != inner_child_pid) {
8cb57430 4253 log_debug("Received notify message without valid credentials. Ignoring.");
9c1e04d0
AP		 4254 return 0;
4255 }
4256
4257 if ((size_t) n >= sizeof(buf)) {
4258 log_warning("Received notify message exceeded maximum size. Ignoring.");
4259 return 0;
4260 }
4261
4262 buf[n] = 0;
4263 tags = strv_split(buf, "\n\r");
4264 if (!tags)
4265 return log_oom();
4266
d29cc4d6 4267 if (strv_contains(tags, "READY=1")) {
d4341b76 4268 r = sd_notify(false, "READY=1\n");
4bf4f50f
ZJS		 4269 if (r < 0)
4270 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
4271 }
9c1e04d0
AP		 4272
4273 p = strv_find_startswith(tags, "STATUS=");
4274 if (p)
04f590a4 4275 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
9c1e04d0
AP		 4276
4277 return 0;
4278}
4279
e96ceaba 4280static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
9c1e04d0 4281 int r;
9c1e04d0 4282
5773024d 4283 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
9c1e04d0
AP		 4284 if (r < 0)
4285 return log_error_errno(r, "Failed to allocate notify event source: %m");
4286
5773024d 4287 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
9c1e04d0
AP		 4288
4289 return 0;
4290}
4291
5d961407
LP		 4292static int merge_settings(Settings *settings, const char *path) {
4293 int rl;
f757855e 4294
5d961407
LP		 4295 assert(settings);
4296 assert(path);
f757855e 4297
5d961407
LP		 4298 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
4299 * that this steals the fields of the Settings* structure, and hence modifies it. */
f757855e 4300
7732f92b
LP		 4301 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
4302 settings->start_mode >= 0) {
4303 arg_start_mode = settings->start_mode;
130d3d22 4304 strv_free_and_replace(arg_parameters, settings->parameters);
f757855e
LP		 4305 }
4306
d3689b94
LP		 4307 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
4308 settings->ephemeral >= 0)
a2f577fc
JL		 4309 arg_ephemeral = settings->ephemeral;
4310
de40a303
LP		 4311 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
4312 settings->root) {
4313
4314 if (!arg_settings_trusted)
4315 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
4316 else
4317 free_and_replace(arg_directory, settings->root);
4318 }
4319
b53ede69
PW		 4320 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
4321 settings->pivot_root_new) {
4322 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
4323 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
4324 }
4325
5f932eb9 4326 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
1cc6c93a
YW		 4327 settings->working_directory)
4328 free_and_replace(arg_chdir, settings->working_directory);
5f932eb9 4329
f757855e 4330 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
130d3d22
YW		 4331 settings->environment)
4332 strv_free_and_replace(arg_setenv, settings->environment);
f757855e 4333
de40a303
LP		 4334 if ((arg_settings_mask & SETTING_USER) == 0) {
4335
4336 if (settings->user)
4337 free_and_replace(arg_user, settings->user);
4338
4339 if (uid_is_valid(settings->uid))
4340 arg_uid = settings->uid;
4341 if (gid_is_valid(settings->gid))
4342 arg_gid = settings->gid;
4343 if (settings->n_supplementary_gids > 0) {
4344 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
4345 arg_n_supplementary_gids = settings->n_supplementary_gids;
4346 }
4347 }
f757855e
LP		 4348
4349 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
a3fc6b55 4350 uint64_t plus, minus;
7be830c6 4351 uint64_t network_minus = 0;
88fc9c9b 4352 uint64_t ambient;
f757855e 4353
de40a303
LP		 4354 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
4355 * Settings structure */
4356
0e265674 4357 plus = settings->capability;
a3fc6b55
LP		 4358 minus = settings->drop_capability;
4359
9baa294c
LP		 4360 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4361 settings_network_configured(settings)) {
a3fc6b55
LP		 4362 if (settings_private_network(settings))
4363 plus |= UINT64_C(1) << CAP_NET_ADMIN;
4364 else
7be830c6 4365 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
a3fc6b55 4366 }
0e265674
LP		 4367
4368 if (!arg_settings_trusted && plus != 0) {
4369 if (settings->capability != 0)
5d961407 4370 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
7be830c6
TH		 4371 } else {
4372 arg_caps_retain &= ~network_minus;
520e0d54 4373 arg_caps_retain |= plus;
7be830c6 4374 }
f757855e 4375
a3fc6b55 4376 arg_caps_retain &= ~minus;
de40a303
LP		 4377
4378 /* Copy the full capabilities over too */
4379 if (capability_quintet_is_set(&settings->full_capabilities)) {
4380 if (!arg_settings_trusted)
5238e957 4381 log_warning("Ignoring capability settings, file %s is not trusted.", path);
de40a303
LP		 4382 else
4383 arg_full_capabilities = settings->full_capabilities;
4384 }
88fc9c9b
TH		 4385
4386 ambient = settings->ambient_capability;
4387 if (!arg_settings_trusted && ambient != 0)
4388 log_warning("Ignoring AmbientCapability= setting, file %s is not trusted.", path);
4389 else
4390 arg_caps_ambient |= ambient;
f757855e
LP		 4391 }
4392
4393 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
4394 settings->kill_signal > 0)
4395 arg_kill_signal = settings->kill_signal;
4396
4397 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
4398 settings->personality != PERSONALITY_INVALID)
4399 arg_personality = settings->personality;
4400
4401 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
4402 !sd_id128_is_null(settings->machine_id)) {
4403
4404 if (!arg_settings_trusted)
5d961407 4405 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
f757855e
LP		 4406 else
4407 arg_uuid = settings->machine_id;
4408 }
4409
4410 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
4411 settings->read_only >= 0)
4412 arg_read_only = settings->read_only;
4413
4414 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
4415 settings->volatile_mode != _VOLATILE_MODE_INVALID)
4416 arg_volatile_mode = settings->volatile_mode;
4417
4418 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
4419 settings->n_custom_mounts > 0) {
4420
4421 if (!arg_settings_trusted)
5d961407 4422 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
f757855e
LP		 4423 else {
4424 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
1cc6c93a 4425 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
f757855e 4426 arg_n_custom_mounts = settings->n_custom_mounts;
f757855e
LP		 4427 settings->n_custom_mounts = 0;
4428 }
4429 }
4430
4431 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
a1dfd585 4432 settings_network_configured(settings)) {
f757855e
LP		 4433
4434 if (!arg_settings_trusted)
5d961407 4435 log_warning("Ignoring network settings, file %s is not trusted.", path);
f757855e 4436 else {
f6d6bad1 4437 arg_network_veth = settings_network_veth(settings);
0e265674
LP		 4438 arg_private_network = settings_private_network(settings);
4439
130d3d22
YW		 4440 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
4441 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
4442 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
4443 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
f6d6bad1 4444
1cc6c93a
YW		 4445 free_and_replace(arg_network_bridge, settings->network_bridge);
4446 free_and_replace(arg_network_zone, settings->network_zone);
de40a303
LP		 4447
4448 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
f757855e
LP		 4449 }
4450 }
4451
4452 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
4453 settings->expose_ports) {
4454
4455 if (!arg_settings_trusted)
5d961407 4456 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
f757855e
LP		 4457 else {
4458 expose_port_free_all(arg_expose_ports);
1cc6c93a 4459 arg_expose_ports = TAKE_PTR(settings->expose_ports);
f757855e
LP		 4460 }
4461 }
4462
0de7acce
LP		 4463 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
4464 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
4465
4466 if (!arg_settings_trusted)
5d961407 4467 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
0de7acce
LP		 4468 else {
4469 arg_userns_mode = settings->userns_mode;
4470 arg_uid_shift = settings->uid_shift;
4471 arg_uid_range = settings->uid_range;
6c045a99 4472 arg_userns_ownership = settings->userns_ownership;
0de7acce
LP		 4473 }
4474 }
4475
0cc3c9f9
LP		 4476 if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
4477 !strv_isempty(settings->bind_user))
2f893044
LP		 4478 strv_free_and_replace(arg_bind_user, settings->bind_user);
4479
d3689b94
LP		 4480 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
4481 settings->notify_ready >= 0)
9c1e04d0
AP		 4482 arg_notify_ready = settings->notify_ready;
4483
960e4569
LP		 4484 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
4485
2d09ea44
LP		 4486 if (!strv_isempty(settings->syscall_allow_list) || !strv_isempty(settings->syscall_deny_list)) {
4487 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
4488 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
4489 else {
4490 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4491 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
4492 }
960e4569 4493 }
de40a303
LP		 4494
4495#if HAVE_SECCOMP
2d09ea44
LP		 4496 if (settings->seccomp) {
4497 if (!arg_settings_trusted)
4498 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4499 else {
4500 seccomp_release(arg_seccomp);
4501 arg_seccomp = TAKE_PTR(settings->seccomp);
4502 }
de40a303
LP		 4503 }
4504#endif
960e4569
LP		 4505 }
4506
bf428efb
LP		 4507 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4508 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4509 continue;
4510
4511 if (!settings->rlimit[rl])
4512 continue;
4513
4514 if (!arg_settings_trusted) {
5d961407 4515 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
bf428efb
LP		 4516 continue;
4517 }
4518
4519 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4520 }
4521
3a9530e5
LP		 4522 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4523 settings->hostname)
4524 free_and_replace(arg_hostname, settings->hostname);
4525
66edd963
LP		 4526 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4527 settings->no_new_privileges >= 0)
4528 arg_no_new_privileges = settings->no_new_privileges;
4529
81f345df
LP		 4530 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4531 settings->oom_score_adjust_set) {
4532
4533 if (!arg_settings_trusted)
5d961407 4534 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
81f345df
LP		 4535 else {
4536 arg_oom_score_adjust = settings->oom_score_adjust;
4537 arg_oom_score_adjust_set = true;
4538 }
4539 }
4540
d107bb7d 4541 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
0985c7c4 4542 settings->cpu_set.set) {
d107bb7d
LP		 4543
4544 if (!arg_settings_trusted)
5d961407 4545 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
d107bb7d 4546 else {
0985c7c4
ZJS		 4547 cpu_set_reset(&arg_cpu_set);
4548 arg_cpu_set = settings->cpu_set;
4549 settings->cpu_set = (CPUSet) {};
d107bb7d
LP		 4550 }
4551 }
4552
09d423e9
LP		 4553 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4554 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4555 arg_resolv_conf = settings->resolv_conf;
4556
4e1d6aa9
LP		 4557 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4558 settings->link_journal != _LINK_JOURNAL_INVALID) {
4559
4560 if (!arg_settings_trusted)
4561 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4562 else {
4563 arg_link_journal = settings->link_journal;
4564 arg_link_journal_try = settings->link_journal_try;
4565 }
4566 }
4567
1688841f
LP		 4568 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4569 settings->timezone != _TIMEZONE_MODE_INVALID)
4570 arg_timezone = settings->timezone;
4571
de40a303
LP		 4572 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4573 settings->slice) {
4574
4575 if (!arg_settings_trusted)
4576 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4577 else
4578 free_and_replace(arg_slice, settings->slice);
4579 }
4580
4581 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4582 settings->use_cgns >= 0) {
4583
4584 if (!arg_settings_trusted)
4585 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4586 else
4587 arg_use_cgns = settings->use_cgns;
4588 }
4589
4590 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
f5fbe71d 4591 settings->clone_ns_flags != ULONG_MAX) {
de40a303
LP		 4592
4593 if (!arg_settings_trusted)
4594 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4595 else
4596 arg_clone_ns_flags = settings->clone_ns_flags;
4597 }
4598
4599 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4600 settings->console_mode >= 0) {
4601
4602 if (!arg_settings_trusted)
4603 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4604 else
4605 arg_console_mode = settings->console_mode;
4606 }
4607
d3689b94
LP		 4608 if ((arg_settings_mask & SETTING_SUPPRESS_SYNC) == 0 &&
4609 settings->suppress_sync >= 0)
4a4654e0
LP		 4610 arg_suppress_sync = settings->suppress_sync;
4611
de40a303
LP		 4612 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4613 * don't consult arg_settings_mask for them. */
4614
4615 sd_bus_message_unref(arg_property_message);
4616 arg_property_message = TAKE_PTR(settings->properties);
4617
4618 arg_console_width = settings->console_width;
4619 arg_console_height = settings->console_height;
4620
b2645747 4621 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
de40a303
LP		 4622 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4623 arg_n_extra_nodes = settings->n_extra_nodes;
4624
f757855e
LP		 4625 return 0;
4626}
4627
5d961407
LP		 4628static int load_settings(void) {
4629 _cleanup_(settings_freep) Settings *settings = NULL;
4630 _cleanup_fclose_ FILE *f = NULL;
3603f151 4631 _cleanup_free_ char *p = NULL;
5d961407
LP		 4632 int r;
4633
de40a303
LP		 4634 if (arg_oci_bundle)
4635 return 0;
4636
5d961407
LP		 4637 /* If all settings are masked, there's no point in looking for
4638 * the settings file */
d7a0f1f4 4639 if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
5d961407
LP		 4640 return 0;
4641
5d961407
LP		 4642 /* We first look in the admin's directories in /etc and /run */
4643 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4644 _cleanup_free_ char *j = NULL;
4645
3603f151 4646 j = path_join(i, arg_settings_filename);
5d961407
LP		 4647 if (!j)
4648 return log_oom();
4649
4650 f = fopen(j, "re");
4651 if (f) {
4652 p = TAKE_PTR(j);
4653
4654 /* By default, we trust configuration from /etc and /run */
4655 if (arg_settings_trusted < 0)
4656 arg_settings_trusted = true;
4657
4658 break;
4659 }
4660
4661 if (errno != ENOENT)
4662 return log_error_errno(errno, "Failed to open %s: %m", j);
4663 }
4664
4665 if (!f) {
4666 /* After that, let's look for a file next to the
4667 * actual image we shall boot. */
4668
4669 if (arg_image) {
3603f151 4670 p = file_in_same_dir(arg_image, arg_settings_filename);
5d961407
LP		 4671 if (!p)
4672 return log_oom();
cd6e3914 4673 } else if (arg_directory && !path_equal(arg_directory, "/")) {
3603f151 4674 p = file_in_same_dir(arg_directory, arg_settings_filename);
5d961407
LP		 4675 if (!p)
4676 return log_oom();
4677 }
4678
4679 if (p) {
4680 f = fopen(p, "re");
4681 if (!f && errno != ENOENT)
4682 return log_error_errno(errno, "Failed to open %s: %m", p);
4683
4684 /* By default, we do not trust configuration from /var/lib/machines */
4685 if (arg_settings_trusted < 0)
4686 arg_settings_trusted = false;
4687 }
4688 }
4689
4690 if (!f)
4691 return 0;
4692
4693 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4694
4695 r = settings_load(f, p, &settings);
4696 if (r < 0)
4697 return r;
4698
4699 return merge_settings(settings, p);
4700}
4701
de40a303
LP		 4702static int load_oci_bundle(void) {
4703 _cleanup_(settings_freep) Settings *settings = NULL;
4704 int r;
4705
4706 if (!arg_oci_bundle)
4707 return 0;
4708
4709 /* By default let's trust OCI bundles */
4710 if (arg_settings_trusted < 0)
4711 arg_settings_trusted = true;
4712
4713 r = oci_load(NULL, arg_oci_bundle, &settings);
4714 if (r < 0)
4715 return r;
4716
4717 return merge_settings(settings, arg_oci_bundle);
4718}
4719
3acc84eb 4720static int run_container(
2d845785 4721 DissectedImage *dissected_image,
b0067625
ZJS		 4722 bool secondary,
4723 FDSet *fds,
4724 char veth_name[IFNAMSIZ], bool *veth_created,
761cf19d 4725 struct ExposeArgs *expose_args,
3acc84eb 4726 int *master, pid_t *pid, int *ret) {
b0067625
ZJS		 4727
4728 static const struct sigaction sa = {
4729 .sa_handler = nop_signal_handler,
e28c7cd0 4730 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
b0067625
ZJS		 4731 };
4732
8e766630 4733 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
b0067625
ZJS		 4734 _cleanup_close_ int etc_passwd_lock = -1;
4735 _cleanup_close_pair_ int
4736 kmsg_socket_pair[2] = { -1, -1 },
4737 rtnl_socket_pair[2] = { -1, -1 },
4738 pid_socket_pair[2] = { -1, -1 },
4739 uuid_socket_pair[2] = { -1, -1 },
4740 notify_socket_pair[2] = { -1, -1 },
8199d554 4741 uid_shift_socket_pair[2] = { -1, -1 },
3acc84eb 4742 master_pty_socket_pair[2] = { -1, -1 },
8199d554
LP		 4743 unified_cgroup_hierarchy_socket_pair[2] = { -1, -1};
4744
3acc84eb 4745 _cleanup_close_ int notify_socket = -1;
b0067625 4746 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
5773024d 4747 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
b0067625
ZJS		 4748 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4749 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4750 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
abdb9b08 4751 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2f893044
LP		 4752 _cleanup_free_ uid_t *bind_user_uid = NULL;
4753 size_t n_bind_user_uid = 0;
b0067625 4754 ContainerStatus container_status = 0;
b0067625
ZJS		 4755 int ifi = 0, r;
4756 ssize_t l;
4757 sigset_t mask_chld;
5b4855ab 4758 _cleanup_close_ int child_netns_fd = -1;
b0067625
ZJS		 4759
4760 assert_se(sigemptyset(&mask_chld) == 0);
4761 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4762
4763 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4764 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4765 * check with getpwuid() if the specific user already exists. Note that /etc might be
4766 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4767 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4768 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4769 * really ours. */
4770
4771 etc_passwd_lock = take_etc_passwd_lock(NULL);
4772 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4773 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4774 }
4775
4776 r = barrier_create(&barrier);
4777 if (r < 0)
4778 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4779
4780 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0)
4781 return log_error_errno(errno, "Failed to create kmsg socket pair: %m");
4782
4783 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, rtnl_socket_pair) < 0)
4784 return log_error_errno(errno, "Failed to create rtnl socket pair: %m");
4785
4786 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, pid_socket_pair) < 0)
4787 return log_error_errno(errno, "Failed to create pid socket pair: %m");
4788
4789 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uuid_socket_pair) < 0)
4790 return log_error_errno(errno, "Failed to create id socket pair: %m");
4791
4792 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, notify_socket_pair) < 0)
4793 return log_error_errno(errno, "Failed to create notify socket pair: %m");
4794
3acc84eb
FB		 4795 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, master_pty_socket_pair) < 0)
4796 return log_error_errno(errno, "Failed to create console socket pair: %m");
4797
b0067625
ZJS		 4798 if (arg_userns_mode != USER_NAMESPACE_NO)
4799 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uid_shift_socket_pair) < 0)
4800 return log_error_errno(errno, "Failed to create uid shift socket pair: %m");
4801
8199d554
LP		 4802 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN)
4803 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, unified_cgroup_hierarchy_socket_pair) < 0)
4804 return log_error_errno(errno, "Failed to create unified cgroup socket pair: %m");
4805
b0067625
ZJS		 4806 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4807 * parent's blocking calls and give it a chance to call wait() and terminate. */
4808 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4809 if (r < 0)
4810 return log_error_errno(errno, "Failed to change the signal mask: %m");
4811
4812 r = sigaction(SIGCHLD, &sa, NULL);
4813 if (r < 0)
4814 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4815
d7bea6b6 4816 if (arg_network_namespace_path) {
5b4855ab
DDM		 4817 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4818 if (child_netns_fd < 0)
d7bea6b6
DP		 4819 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4820
54c2459d 4821 r = fd_is_ns(child_netns_fd, CLONE_NEWNET);
6619ad88
LP		 4822 if (r == -EUCLEAN)
4823 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4824 else if (r < 0)
d7bea6b6 4825 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
c6147113
LP		 4826 else if (r == 0)
4827 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4828 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
d7bea6b6
DP		 4829 }
4830
b0067625
ZJS		 4831 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4832 if (*pid < 0)
4833 return log_error_errno(errno, "clone() failed%s: %m",
4834 errno == EINVAL ?
4835 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4836
4837 if (*pid == 0) {
4838 /* The outer child only has a file system namespace. */
4839 barrier_set_role(&barrier, BARRIER_CHILD);
4840
b0067625
ZJS		 4841 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
4842 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
4843 pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
4844 uuid_socket_pair[0] = safe_close(uuid_socket_pair[0]);
4845 notify_socket_pair[0] = safe_close(notify_socket_pair[0]);
3acc84eb 4846 master_pty_socket_pair[0] = safe_close(master_pty_socket_pair[0]);
b0067625 4847 uid_shift_socket_pair[0] = safe_close(uid_shift_socket_pair[0]);
8199d554 4848 unified_cgroup_hierarchy_socket_pair[0] = safe_close(unified_cgroup_hierarchy_socket_pair[0]);
b0067625
ZJS		 4849
4850 (void) reset_all_signal_handlers();
4851 (void) reset_signal_mask();
4852
4853 r = outer_child(&barrier,
4854 arg_directory,
2d845785 4855 dissected_image,
b0067625
ZJS		 4856 secondary,
4857 pid_socket_pair[1],
4858 uuid_socket_pair[1],
4859 notify_socket_pair[1],
4860 kmsg_socket_pair[1],
4861 rtnl_socket_pair[1],
4862 uid_shift_socket_pair[1],
3acc84eb 4863 master_pty_socket_pair[1],
8199d554 4864 unified_cgroup_hierarchy_socket_pair[1],
d7bea6b6 4865 fds,
5b4855ab 4866 child_netns_fd);
b0067625
ZJS		 4867 if (r < 0)
4868 _exit(EXIT_FAILURE);
4869
4870 _exit(EXIT_SUCCESS);
4871 }
4872
4873 barrier_set_role(&barrier, BARRIER_PARENT);
4874
e4077ff6 4875 fdset_close(fds);
b0067625
ZJS		 4876
4877 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
4878 rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
4879 pid_socket_pair[1] = safe_close(pid_socket_pair[1]);
4880 uuid_socket_pair[1] = safe_close(uuid_socket_pair[1]);
4881 notify_socket_pair[1] = safe_close(notify_socket_pair[1]);
3acc84eb 4882 master_pty_socket_pair[1] = safe_close(master_pty_socket_pair[1]);
b0067625 4883 uid_shift_socket_pair[1] = safe_close(uid_shift_socket_pair[1]);
8199d554 4884 unified_cgroup_hierarchy_socket_pair[1] = safe_close(unified_cgroup_hierarchy_socket_pair[1]);
b0067625
ZJS		 4885
4886 if (arg_userns_mode != USER_NAMESPACE_NO) {
4887 /* The child just let us know the UID shift it might have read from the image. */
4888 l = recv(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
4889 if (l < 0)
4890 return log_error_errno(errno, "Failed to read UID shift: %m");
c6147113
LP		 4891 if (l != sizeof arg_uid_shift)
4892 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
b0067625
ZJS		 4893
4894 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4895 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4896 * image, but if that's already in use, pick a new one, and report back to the child,
4897 * which one we now picked. */
4898
4899 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4900 if (r < 0)
4901 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4902
4903 l = send(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
4904 if (l < 0)
4905 return log_error_errno(errno, "Failed to send UID shift: %m");
c6147113
LP		 4906 if (l != sizeof arg_uid_shift)
4907 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
b0067625 4908 }
2f893044
LP		 4909
4910 n_bind_user_uid = strv_length(arg_bind_user);
4911 if (n_bind_user_uid > 0) {
4912 /* Right after the UID shift, we'll receive the list of UID mappings for the
4913 * --bind-user= logic. Always a quadruplet of payload and host UID + GID. */
4914
4915 bind_user_uid = new(uid_t, n_bind_user_uid*4);
4916 if (!bind_user_uid)
4917 return log_oom();
4918
4919 for (size_t i = 0; i < n_bind_user_uid; i++) {
4920 l = recv(uid_shift_socket_pair[0], bind_user_uid + i*4, sizeof(uid_t)*4, 0);
4921 if (l < 0)
4922 return log_error_errno(errno, "Failed to read user UID map pair: %m");
4923 if (l != sizeof(uid_t)*4)
4924 return log_full_errno(l == 0 ? LOG_DEBUG : LOG_WARNING,
4925 SYNTHETIC_ERRNO(EIO),
4926 "Short read while reading bind user UID pairs.");
4927 }
4928 }
b0067625
ZJS		 4929 }
4930
8199d554
LP		 4931 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4932 /* The child let us know the support cgroup mode it might have read from the image. */
4933 l = recv(unified_cgroup_hierarchy_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
4934 if (l < 0)
4935 return log_error_errno(errno, "Failed to read cgroup mode: %m");
c6147113 4936 if (l != sizeof(arg_unified_cgroup_hierarchy))
c0f86d66 4937 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
c6147113 4938 l, l == 0 ? " The child is most likely dead." : "");
8199d554
LP		 4939 }
4940
b0067625 4941 /* Wait for the outer child. */
d2e0ac3d
LP		 4942 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4943 if (r < 0)
4944 return r;
4945 if (r != EXIT_SUCCESS)
4946 return -EIO;
b0067625
ZJS		 4947
4948 /* And now retrieve the PID of the inner child. */
4949 l = recv(pid_socket_pair[0], pid, sizeof *pid, 0);
4950 if (l < 0)
4951 return log_error_errno(errno, "Failed to read inner child PID: %m");
c6147113
LP		 4952 if (l != sizeof *pid)
4953 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
b0067625
ZJS		 4954
4955 /* We also retrieve container UUID in case it was generated by outer child */
4956 l = recv(uuid_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
4957 if (l < 0)
4958 return log_error_errno(errno, "Failed to read container machine ID: %m");
c6147113
LP		 4959 if (l != sizeof(arg_uuid))
4960 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
b0067625
ZJS		 4961
4962 /* We also retrieve the socket used for notifications generated by outer child */
4963 notify_socket = receive_one_fd(notify_socket_pair[0], 0);
4964 if (notify_socket < 0)
4965 return log_error_errno(notify_socket,
4966 "Failed to receive notification socket from the outer child: %m");
4967
4968 log_debug("Init process invoked as PID "PID_FMT, *pid);
4969
4970 if (arg_userns_mode != USER_NAMESPACE_NO) {
c6147113
LP		 4971 if (!barrier_place_and_sync(&barrier)) /* #1 */
4972 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 4973
2f893044 4974 r = setup_uid_map(*pid, bind_user_uid, n_bind_user_uid);
b0067625
ZJS		 4975 if (r < 0)
4976 return r;
4977
4978 (void) barrier_place(&barrier); /* #2 */
4979 }
4980
4981 if (arg_private_network) {
75116558
PS		 4982 if (!arg_network_namespace_path) {
4983 /* Wait until the child has unshared its network namespace. */
c6147113
LP		 4984 if (!barrier_place_and_sync(&barrier)) /* #3 */
4985 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
75116558
PS		 4986 }
4987
5b4855ab
DDM		 4988 if (child_netns_fd < 0) {
4989 /* Make sure we have an open file descriptor to the child's network
4990 * namespace so it stays alive even if the child exits. */
4991 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
4992 if (r < 0)
4993 return log_error_errno(r, "Failed to open child network namespace: %m");
4994 }
4995
4996 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
b0067625
ZJS		 4997 if (r < 0)
4998 return r;
4999
5000 if (arg_network_veth) {
5001 r = setup_veth(arg_machine, *pid, veth_name,
5002 arg_network_bridge || arg_network_zone);
5003 if (r < 0)
5004 return r;
5005 else if (r > 0)
5006 ifi = r;
5007
5008 if (arg_network_bridge) {
5009 /* Add the interface to a bridge */
5010 r = setup_bridge(veth_name, arg_network_bridge, false);
5011 if (r < 0)
5012 return r;
5013 if (r > 0)
5014 ifi = r;
5015 } else if (arg_network_zone) {
5016 /* Add the interface to a bridge, possibly creating it */
5017 r = setup_bridge(veth_name, arg_network_zone, true);
5018 if (r < 0)
5019 return r;
5020 if (r > 0)
5021 ifi = r;
5022 }
5023 }
5024
5025 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
5026 if (r < 0)
5027 return r;
5028
5029 /* We created the primary and extra veth links now; let's remember this, so that we know to
5030 remove them later on. Note that we don't bother with removing veth links that were created
5031 here when their setup failed half-way, because in that case the kernel should be able to
5032 remove them on its own, since they cannot be referenced by anything yet. */
5033 *veth_created = true;
5034
5035 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
5036 if (r < 0)
5037 return r;
5038
5039 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
5040 if (r < 0)
5041 return r;
5042 }
5043
abdb9b08
LP		 5044 if (arg_register || !arg_keep_unit) {
5045 r = sd_bus_default_system(&bus);
5046 if (r < 0)
5047 return log_error_errno(r, "Failed to open system bus: %m");
e5a2d8b5
LP		 5048
5049 r = sd_bus_set_close_on_exit(bus, false);
5050 if (r < 0)
5051 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
abdb9b08
LP		 5052 }
5053
5054 if (!arg_keep_unit) {
5055 /* When a new scope is created for this container, then we'll be registered as its controller, in which
5056 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
5057 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
5058
75152a4d
LP		 5059 r = sd_bus_match_signal_async(
5060 bus,
5061 NULL,
5062 "org.freedesktop.systemd1",
5063 NULL,
5064 "org.freedesktop.systemd1.Scope",
5065 "RequestStop",
5066 on_request_stop, NULL, PID_TO_PTR(*pid));
abdb9b08 5067 if (r < 0)
75152a4d 5068 return log_error_errno(r, "Failed to request RequestStop match: %m");
abdb9b08
LP		 5069 }
5070
b0067625
ZJS		 5071 if (arg_register) {
5072 r = register_machine(
abdb9b08 5073 bus,
b0067625
ZJS		 5074 arg_machine,
5075 *pid,
5076 arg_directory,
5077 arg_uuid,
5078 ifi,
5079 arg_slice,
5080 arg_custom_mounts, arg_n_custom_mounts,
5081 arg_kill_signal,
5082 arg_property,
de40a303 5083 arg_property_message,
b0067625
ZJS		 5084 arg_keep_unit,
5085 arg_container_service_name);
5086 if (r < 0)
5087 return r;
abdb9b08 5088
cd2dfc6f
LP		 5089 } else if (!arg_keep_unit) {
5090 r = allocate_scope(
abdb9b08 5091 bus,
cd2dfc6f
LP		 5092 arg_machine,
5093 *pid,
5094 arg_slice,
5095 arg_custom_mounts, arg_n_custom_mounts,
5096 arg_kill_signal,
de40a303
LP		 5097 arg_property,
5098 arg_property_message);
cd2dfc6f
LP		 5099 if (r < 0)
5100 return r;
5101
5102 } else if (arg_slice || arg_property)
5103 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
b0067625 5104
27da7ef0 5105 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
b0067625
ZJS		 5106 if (r < 0)
5107 return r;
5108
27da7ef0 5109 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
720f0a2f
LP		 5110 if (r < 0)
5111 return r;
b0067625 5112
de54e02d 5113 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
b0067625
ZJS		 5114 if (r < 0)
5115 return r;
5116
5117 /* Notify the child that the parent is ready with all
5118 * its setup (including cgroup-ification), and that
5119 * the child can now hand over control to the code to
5120 * run inside the container. */
75116558 5121 (void) barrier_place(&barrier); /* #4 */
b0067625
ZJS		 5122
5123 /* Block SIGCHLD here, before notifying child.
5124 * process_pty() will handle it with the other signals. */
5125 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
5126
5127 /* Reset signal to default */
9c274488 5128 r = default_signals(SIGCHLD);
b0067625
ZJS		 5129 if (r < 0)
5130 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
5131
5132 r = sd_event_new(&event);
5133 if (r < 0)
5134 return log_error_errno(r, "Failed to get default event source: %m");
5135
8fd010bb
LP		 5136 (void) sd_event_set_watchdog(event, true);
5137
abdb9b08
LP		 5138 if (bus) {
5139 r = sd_bus_attach_event(bus, event, 0);
5140 if (r < 0)
5141 return log_error_errno(r, "Failed to attach bus to event loop: %m");
5142 }
5143
e96ceaba 5144 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
b0067625
ZJS		 5145 if (r < 0)
5146 return r;
5147
5148 /* Let the child know that we are ready and wait that the child is completely ready now. */
c6147113
LP		 5149 if (!barrier_place_and_sync(&barrier)) /* #5 */
5150 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 5151
38ccb557 5152 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
b0067625
ZJS		 5153 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
5154 etc_passwd_lock = safe_close(etc_passwd_lock);
5155
04f590a4
LP		 5156 (void) sd_notifyf(false,
5157 "STATUS=Container running.\n"
5158 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
4bf4f50f
ZJS		 5159 if (!arg_notify_ready) {
5160 r = sd_notify(false, "READY=1\n");
5161 if (r < 0)
5162 log_warning_errno(r, "Failed to send readiness notification, ignoring: %m");
5163 }
b0067625
ZJS		 5164
5165 if (arg_kill_signal > 0) {
5166 /* Try to kill the init system on SIGINT or SIGTERM */
919f5ae0
LP		 5167 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
5168 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
b0067625
ZJS		 5169 } else {
5170 /* Immediately exit */
919f5ae0
LP		 5171 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
5172 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
b0067625
ZJS		 5173 }
5174
6916b164 5175 /* Exit when the child exits */
919f5ae0 5176 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
b0067625
ZJS		 5177
5178 if (arg_expose_ports) {
761cf19d 5179 r = expose_port_watch_rtnl(event, rtnl_socket_pair[0], on_address_change, expose_args, &rtnl);
b0067625
ZJS		 5180 if (r < 0)
5181 return r;
5182
deff68e7
FW		 5183 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5184 (void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5185 }
5186
5187 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
5188
3acc84eb
FB		 5189 if (arg_console_mode != CONSOLE_PIPE) {
5190 _cleanup_close_ int fd = -1;
5191 PTYForwardFlags flags = 0;
de40a303 5192
3acc84eb
FB		 5193 /* Retrieve the master pty allocated by inner child */
5194 fd = receive_one_fd(master_pty_socket_pair[0], 0);
5195 if (fd < 0)
5196 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
5197
5198 switch (arg_console_mode) {
de40a303 5199
3acc84eb
FB		 5200 case CONSOLE_READ_ONLY:
5201 flags |= PTY_FORWARD_READ_ONLY;
5202
5203 _fallthrough_;
5204
5205 case CONSOLE_INTERACTIVE:
5206 flags |= PTY_FORWARD_IGNORE_VHANGUP;
5207
5208 r = pty_forward_new(event, fd, flags, &forward);
5209 if (r < 0)
5210 return log_error_errno(r, "Failed to create PTY forwarder: %m");
5211
f5fbe71d 5212 if (arg_console_width != UINT_MAX || arg_console_height != UINT_MAX)
3acc84eb
FB		 5213 (void) pty_forward_set_width_height(forward,
5214 arg_console_width,
5215 arg_console_height);
5216 break;
5217
5218 default:
5219 assert(arg_console_mode == CONSOLE_PASSIVE);
5220 }
5221
5222 *master = TAKE_FD(fd);
de40a303 5223 }
b0067625
ZJS		 5224
5225 r = sd_event_loop(event);
5226 if (r < 0)
5227 return log_error_errno(r, "Failed to run event loop: %m");
5228
de40a303
LP		 5229 if (forward) {
5230 char last_char = 0;
b0067625 5231
de40a303
LP		 5232 (void) pty_forward_get_last_char(forward, &last_char);
5233 forward = pty_forward_free(forward);
b0067625 5234
de40a303
LP		 5235 if (!arg_quiet && last_char != '\n')
5236 putc('\n', stdout);
5237 }
b0067625
ZJS		 5238
5239 /* Kill if it is not dead yet anyway */
0bb0a9fa
ZJS		 5240 if (!arg_register && !arg_keep_unit && bus)
5241 terminate_scope(bus, arg_machine);
b0067625
ZJS		 5242
5243 /* Normally redundant, but better safe than sorry */
c67b0082 5244 (void) kill(*pid, SIGKILL);
b0067625 5245
5b4855ab
DDM		 5246 if (arg_private_network) {
5247 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
5248 * to avoid having to move the parent to the child network namespace. */
5249 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
5250 if (r < 0)
5251 return r;
5252
5253 if (r == 0) {
5254 _cleanup_close_ int parent_netns_fd = -1;
5255
5256 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
5257 if (r < 0) {
5258 log_error_errno(r, "Failed to open parent network namespace: %m");
5259 _exit(EXIT_FAILURE);
5260 }
5261
5262 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
5263 if (r < 0) {
5264 log_error_errno(r, "Failed to enter child network namespace: %m");
5265 _exit(EXIT_FAILURE);
5266 }
5267
5268 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
5269 if (r < 0)
5270 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
5271
5272 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
5273 }
5274 }
5275
8f03de53 5276 r = wait_for_container(TAKE_PID(*pid), &container_status);
b0067625 5277
0bb0a9fa
ZJS		 5278 /* Tell machined that we are gone. */
5279 if (bus)
5280 (void) unregister_machine(bus, arg_machine);
5281
b0067625
ZJS		 5282 if (r < 0)
5283 /* We failed to wait for the container, or the container exited abnormally. */
5284 return r;
5285 if (r > 0 || container_status == CONTAINER_TERMINATED) {
27e29a1e
ZJS		 5286 /* r > 0 → The container exited with a non-zero status.
5287 * As a special case, we need to replace 133 with a different value,
5288 * because 133 is special-cased in the service file to reboot the container.
5289 * otherwise → The container exited with zero status and a reboot was not requested.
5290 */
2a49b612 5291 if (r == EXIT_FORCE_RESTART)
27e29a1e 5292 r = EXIT_FAILURE; /* replace 133 with the general failure code */
b0067625 5293 *ret = r;
b0067625
ZJS		 5294 return 0; /* finito */
5295 }
5296
5297 /* CONTAINER_REBOOTED, loop again */
5298
5299 if (arg_keep_unit) {
5300 /* Special handling if we are running as a service: instead of simply
5301 * restarting the machine we want to restart the entire service, so let's
5302 * inform systemd about this with the special exit code 133. The service
5303 * file uses RestartForceExitStatus=133 so that this results in a full
5304 * nspawn restart. This is necessary since we might have cgroup parameters
5305 * set we want to have flushed out. */
2a49b612
ZJS		 5306 *ret = EXIT_FORCE_RESTART;
5307 return 0; /* finito */
b0067625
ZJS		 5308 }
5309
deff68e7
FW		 5310 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
5311 expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
b0067625
ZJS		 5312
5313 (void) remove_veth_links(veth_name, arg_network_veth_extra);
5314 *veth_created = false;
5315 return 1; /* loop again */
5316}
5317
bf428efb 5318static int initialize_rlimits(void) {
852b6250 5319 /* The default resource limits the kernel passes to PID 1, as per kernel 5.16. Let's pass our container payload
bf428efb
LP		 5320 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
5321 * container execution environments. */
5322
5323 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
852b6250
LP		 5324 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
5325 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
5326 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
5327 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
5328 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
5329 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
5330 [RLIMIT_MEMLOCK] = { DEFAULT_RLIMIT_MEMLOCK, DEFAULT_RLIMIT_MEMLOCK },
5331 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
5332 [RLIMIT_NICE] = { 0, 0 },
5333 [RLIMIT_NOFILE] = { 1024, 4096 },
5334 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
5335 [RLIMIT_RTPRIO] = { 0, 0 },
5336 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
5337 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
bf428efb
LP		 5338
5339 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
5340 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
5341 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
5342 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
5343 * that PID 1 changes a number of other resource limits during early initialization which is why we
5344 * don't read the other limits from PID 1 but prefer the static table above. */
5345 };
5346
5347 int rl;
5348
5349 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
bf428efb
LP		 5350 /* Let's only fill in what the user hasn't explicitly configured anyway */
5351 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
5352 const struct rlimit *v;
5353 struct rlimit buffer;
5354
5355 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
5356 /* For these two let's read the limits off PID 1. See above for an explanation. */
5357
5358 if (prlimit(1, rl, NULL, &buffer) < 0)
5359 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
5360
dbf1aca6
LP		 5361 v = &buffer;
5362 } else if (rl == RLIMIT_NOFILE) {
5363 /* We nowadays bump RLIMIT_NOFILE's hard limit early in PID 1 for all
5364 * userspace. Given that nspawn containers are often run without our PID 1,
5365 * let's grant the containers a raised RLIMIT_NOFILE hard limit by default,
5366 * so that container userspace gets similar resources as host userspace
5367 * gets. */
5368 buffer = kernel_defaults[rl];
5369 buffer.rlim_max = MIN((rlim_t) read_nr_open(), (rlim_t) HIGH_RLIMIT_NOFILE);
bf428efb
LP		 5370 v = &buffer;
5371 } else
5372 v = kernel_defaults + rl;
5373
5374 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
5375 if (!arg_rlimit[rl])
5376 return log_oom();
5377 }
5378
5379 if (DEBUG_LOGGING) {
5380 _cleanup_free_ char *k = NULL;
5381
5382 (void) rlimit_format(arg_rlimit[rl], &k);
5383 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
5384 }
5385 }
5386
5387 return 0;
5388}
5389
287b7376 5390static int cant_be_in_netns(void) {
287b7376
LP		 5391 char udev_path[STRLEN("/proc//ns/net") + DECIMAL_STR_MAX(pid_t)];
5392 _cleanup_free_ char *udev_ns = NULL, *our_ns = NULL;
5393 _cleanup_close_ int fd = -1;
5394 struct ucred ucred;
5395 int r;
5396
5397 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
5398 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
5399 * nice message. */
5400
5401 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
5402 return 0;
5403
5404 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
5405 if (fd < 0)
5406 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
5407
1861986a
LP		 5408 r = connect_unix_path(fd, AT_FDCWD, "/run/udev/control");
5409 if (r < 0) {
5410 if (r == -ENOENT || ERRNO_IS_DISCONNECT(r))
287b7376
LP		 5411 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5412 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
5413
1861986a 5414 return log_error_errno(r, "Failed to connect socket to udev control socket: %m");
287b7376
LP		 5415 }
5416
5417 r = getpeercred(fd, &ucred);
5418 if (r < 0)
5419 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
5420
5421 xsprintf(udev_path, "/proc/" PID_FMT "/ns/net", ucred.pid);
5422 r = readlink_malloc(udev_path, &udev_ns);
5423 if (r < 0)
5424 return log_error_errno(r, "Failed to read network namespace of udev: %m");
5425
5426 r = readlink_malloc("/proc/self/ns/net", &our_ns);
5427 if (r < 0)
5428 return log_error_errno(r, "Failed to read our own network namespace: %m");
5429
5430 if (!streq(our_ns, udev_ns))
5431 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5432 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
5433 return 0;
5434}
5435
44dbef90 5436static int run(int argc, char *argv[]) {
7bf011e3
LP		 5437 bool secondary = false, remove_directory = false, remove_image = false,
5438 veth_created = false, remove_tmprootdir = false;
2d845785 5439 _cleanup_close_ int master = -1;
03cfe0d5 5440 _cleanup_fdset_free_ FDSet *fds = NULL;
2d845785 5441 int r, n_fd_passed, ret = EXIT_SUCCESS;
5aa3eba5 5442 char veth_name[IFNAMSIZ] = "";
761cf19d 5443 struct ExposeArgs expose_args = {};
8e766630 5444 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
c67b0082 5445 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
2d845785 5446 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
18b5886e
LP		 5447 _cleanup_(decrypted_image_unrefp) DecryptedImage *decrypted_image = NULL;
5448 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
761cf19d 5449 _cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
7bf011e3 5450 pid_t pid = 0;
03cfe0d5
LP		 5451
5452 log_parse_environment();
5453 log_open();
415fc41c 5454
03cfe0d5
LP		 5455 r = parse_argv(argc, argv);
5456 if (r <= 0)
5457 goto finish;
5458
38ee19c0
ZJS		 5459 if (geteuid() != 0) {
5460 r = log_warning_errno(SYNTHETIC_ERRNO(EPERM),
5461 argc >= 2 ? "Need to be root." :
5462 "Need to be root (and some arguments are usually required).\nHint: try --help");
03cfe0d5 5463 goto finish;
38ee19c0 5464 }
fba868fa 5465
287b7376
LP		 5466 r = cant_be_in_netns();
5467 if (r < 0)
5468 goto finish;
5469
bf428efb
LP		 5470 r = initialize_rlimits();
5471 if (r < 0)
5472 goto finish;
5473
de40a303
LP		 5474 r = load_oci_bundle();
5475 if (r < 0)
5476 goto finish;
5477
f757855e
LP		 5478 r = determine_names();
5479 if (r < 0)
5480 goto finish;
5481
5482 r = load_settings();
5483 if (r < 0)
5484 goto finish;
5485
d4d99bc6 5486 r = cg_unified();
5eee8290
LP		 5487 if (r < 0) {
5488 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
5489 goto finish;
5490 }
5491
f757855e
LP		 5492 r = verify_arguments();
5493 if (r < 0)
5494 goto finish;
03cfe0d5 5495
49048684
ZJS		 5496 /* Reapply environment settings. */
5497 (void) detect_unified_cgroup_hierarchy_from_environment();
8199d554 5498
2949ff26
LP		 5499 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
5500 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
5501 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
9c274488 5502 (void) ignore_signals(SIGPIPE);
2949ff26 5503
03cfe0d5
LP		 5504 n_fd_passed = sd_listen_fds(false);
5505 if (n_fd_passed > 0) {
5506 r = fdset_new_listen_fds(&fds, false);
5507 if (r < 0) {
5508 log_error_errno(r, "Failed to collect file descriptors: %m");
5509 goto finish;
5510 }
5511 }
5512
83e803a9
ZJS		 5513 /* The "default" umask. This is appropriate for most file and directory
5514 * operations performed by nspawn, and is the umask that will be used for
5515 * the child. Functions like copy_devnodes() change the umask temporarily. */
5516 umask(0022);
5517
03cfe0d5
LP		 5518 if (arg_directory) {
5519 assert(!arg_image);
5520
b35ca61a
LP		 5521 /* Safety precaution: let's not allow running images from the live host OS image, as long as
5522 * /var from the host will propagate into container dynamically (because bad things happen if
5523 * two systems write to the same /var). Let's allow it for the special cases where /var is
5524 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
5525 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
5526 log_error("Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
03cfe0d5
LP		 5527 r = -EINVAL;
5528 goto finish;
5529 }
5530
5531 if (arg_ephemeral) {
5532 _cleanup_free_ char *np = NULL;
5533
8d4aa2bb 5534 r = chase_symlinks_and_update(&arg_directory, 0);
3f342ec4
LP		 5535 if (r < 0)
5536 goto finish;
5537
7bf011e3
LP		 5538 /* If the specified path is a mount point we generate the new snapshot immediately
5539 * inside it under a random name. However if the specified is not a mount point we
5540 * create the new snapshot in the parent directory, just next to it. */
e1873695 5541 r = path_is_mount_point(arg_directory, NULL, 0);
03cfe0d5
LP		 5542 if (r < 0) {
5543 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5544 goto finish;
5545 }
5546 if (r > 0)
770b5ce4 5547 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 5548 else
770b5ce4 5549 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5 5550 if (r < 0) {
0f3be6ca 5551 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
03cfe0d5
LP		 5552 goto finish;
5553 }
5554
6992459c 5555 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
162392b7 5556 * only owned by us and no one else. */
6992459c 5557 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
03cfe0d5
LP		 5558 if (r < 0) {
5559 log_error_errno(r, "Failed to lock %s: %m", np);
5560 goto finish;
5561 }
5562
7bf011e3
LP		 5563 {
5564 BLOCK_SIGNALS(SIGINT);
5565 r = btrfs_subvol_snapshot(arg_directory, np,
5566 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5567 BTRFS_SNAPSHOT_FALLBACK_COPY |
5568 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5569 BTRFS_SNAPSHOT_RECURSIVE |
5570 BTRFS_SNAPSHOT_QUOTA |
5571 BTRFS_SNAPSHOT_SIGINT);
5572 }
5573 if (r == -EINTR) {
5574 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5575 goto finish;
5576 }
03cfe0d5
LP		 5577 if (r < 0) {
5578 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5579 goto finish;
ec16945e
LP		 5580 }
5581
1cc6c93a 5582 free_and_replace(arg_directory, np);
17cbb288 5583 remove_directory = true;
30535c16 5584 } else {
cb638b5e 5585 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
8d4aa2bb
LP		 5586 if (r < 0)
5587 goto finish;
5588
30535c16
LP		 5589 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5590 if (r == -EBUSY) {
5591 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5592 goto finish;
5593 }
5594 if (r < 0) {
5595 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
476b8254 5596 goto finish;
30535c16
LP		 5597 }
5598
5599 if (arg_template) {
8d4aa2bb 5600 r = chase_symlinks_and_update(&arg_template, 0);
3f342ec4
LP		 5601 if (r < 0)
5602 goto finish;
5603
7bf011e3
LP		 5604 {
5605 BLOCK_SIGNALS(SIGINT);
5606 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5607 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5608 BTRFS_SNAPSHOT_FALLBACK_COPY |
5609 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5610 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5611 BTRFS_SNAPSHOT_RECURSIVE |
5612 BTRFS_SNAPSHOT_QUOTA |
5613 BTRFS_SNAPSHOT_SIGINT);
5614 }
ff6c6cc1
LP		 5615 if (r == -EEXIST)
5616 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5617 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
7bf011e3
LP		 5618 else if (r == -EINTR) {
5619 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5620 goto finish;
5621 } else if (r < 0) {
83521414 5622 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16 5623 goto finish;
ff6c6cc1
LP		 5624 } else
5625 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5626 "Populated %s from template %s.", arg_directory, arg_template);
30535c16 5627 }
ec16945e
LP		 5628 }
5629
7732f92b 5630 if (arg_start_mode == START_BOOT) {
aff7ae0d 5631 _cleanup_free_ char *b = NULL;
a5201ed6 5632 const char *p;
c9fe05e0 5633
aff7ae0d
LP		 5634 if (arg_pivot_root_new) {
5635 b = path_join(arg_directory, arg_pivot_root_new);
5636 if (!b)
5637 return log_oom();
5638
5639 p = b;
5640 } else
a5201ed6 5641 p = arg_directory;
c9fe05e0
AR		 5642
5643 if (path_is_os_tree(p) <= 0) {
aff7ae0d
LP		 5644 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5645 "Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
1b9e5b12
LP		 5646 goto finish;
5647 }
5648 } else {
aff7ae0d 5649 _cleanup_free_ char *p = NULL;
c9fe05e0 5650
a5201ed6 5651 if (arg_pivot_root_new)
aff7ae0d 5652 p = path_join(arg_directory, arg_pivot_root_new, "/usr/");
a5201ed6 5653 else
aff7ae0d
LP		 5654 p = path_join(arg_directory, "/usr/");
5655 if (!p)
5656 return log_oom();
1b9e5b12 5657
aff7ae0d
LP		 5658 if (laccess(p, F_OK) < 0) {
5659 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL),
5660 "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
1b9e5b12 5661 goto finish;
1b9e5b12
LP		 5662 }
5663 }
ec16945e 5664
6b9132a9 5665 } else {
d04faa4e 5666 DissectImageFlags dissect_image_flags =
4b5de5dd 5667 DISSECT_IMAGE_GENERIC_ROOT |
d04faa4e
LP		 5668 DISSECT_IMAGE_REQUIRE_ROOT |
5669 DISSECT_IMAGE_RELAX_VAR_CHECK |
5670 DISSECT_IMAGE_USR_NO_ROOT;
ec16945e
LP		 5671 assert(arg_image);
5672 assert(!arg_template);
5673
8d4aa2bb 5674 r = chase_symlinks_and_update(&arg_image, 0);
3f342ec4
LP		 5675 if (r < 0)
5676 goto finish;
5677
0f3be6ca
LP		 5678 if (arg_ephemeral) {
5679 _cleanup_free_ char *np = NULL;
5680
5681 r = tempfn_random(arg_image, "machine.", &np);
5682 if (r < 0) {
5683 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5684 goto finish;
5685 }
5686
6992459c
LP		 5687 /* Always take an exclusive lock on our own ephemeral copy. */
5688 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
0f3be6ca
LP		 5689 if (r < 0) {
5690 r = log_error_errno(r, "Failed to create image lock: %m");
5691 goto finish;
5692 }
5693
7bf011e3
LP		 5694 {
5695 BLOCK_SIGNALS(SIGINT);
5696 r = copy_file(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600, FS_NOCOW_FL, FS_NOCOW_FL, COPY_REFLINK|COPY_CRTIME|COPY_SIGINT);
5697 }
5698 if (r == -EINTR) {
5699 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5700 goto finish;
5701 }
0f3be6ca
LP		 5702 if (r < 0) {
5703 r = log_error_errno(r, "Failed to copy image file: %m");
5704 goto finish;
5705 }
5706
1cc6c93a 5707 free_and_replace(arg_image, np);
0f3be6ca
LP		 5708 remove_image = true;
5709 } else {
5710 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5711 if (r == -EBUSY) {
5712 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5713 goto finish;
5714 }
5715 if (r < 0) {
5716 r = log_error_errno(r, "Failed to create image lock: %m");
5717 goto finish;
5718 }
4623e8e6 5719
89e62e0b
LP		 5720 r = verity_settings_load(
5721 &arg_verity_settings,
5722 arg_image, NULL, NULL);
e7cbe5cb
LB		 5723 if (r < 0) {
5724 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5725 goto finish;
78ebe980 5726 }
89e62e0b
LP		 5727
5728 if (arg_verity_settings.data_path)
5729 dissect_image_flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
30535c16
LP		 5730 }
5731
c67b0082 5732 if (!mkdtemp(tmprootdir)) {
0f3be6ca 5733 r = log_error_errno(errno, "Failed to create temporary directory: %m");
6b9132a9 5734 goto finish;
1b9e5b12 5735 }
6b9132a9 5736
c67b0082
LP		 5737 remove_tmprootdir = true;
5738
5739 arg_directory = strdup(tmprootdir);
1b9e5b12
LP		 5740 if (!arg_directory) {
5741 r = log_oom();
5742 goto finish;
6b9132a9 5743 }
88213476 5744
89e62e0b
LP		 5745 r = loop_device_make_by_path(
5746 arg_image,
5747 arg_read_only ? O_RDONLY : O_RDWR,
5748 FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
5749 &loop);
2d845785
LP		 5750 if (r < 0) {
5751 log_error_errno(r, "Failed to set up loopback block device: %m");
842f3b0f
LP		 5752 goto finish;
5753 }
1b9e5b12 5754
41bc4849
LP		 5755 /* Take a LOCK_SH lock on the device, so that udevd doesn't issue BLKRRPART in our back */
5756 r = loop_device_flock(loop, LOCK_SH);
5757 if (r < 0) {
5758 log_error_errno(r, "Failed to take lock on loopback block device: %m");
5759 goto finish;
5760 }
5761
4526113f 5762 r = dissect_image_and_warn(
e0f9e7bd 5763 loop->fd,
4526113f 5764 arg_image,
89e62e0b 5765 &arg_verity_settings,
18d73705 5766 NULL,
a3642997 5767 loop->diskseq,
75dc190d 5768 loop->uevent_seqnum_not_before,
4a62257d 5769 loop->timestamp_not_before,
e7cbe5cb 5770 dissect_image_flags,
e0f9e7bd 5771 &dissected_image);
2d845785 5772 if (r == -ENOPKG) {
4526113f 5773 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
2d845785
LP		 5774 log_notice("Note that the disk image needs to\n"
5775 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5776 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
19ac32cd 5777 " c) or follow https://systemd.io/DISCOVERABLE_PARTITIONS\n"
2d845785
LP		 5778 " d) or contain a file system without a partition table\n"
5779 "in order to be bootable with systemd-nspawn.");
1b9e5b12 5780 goto finish;
2d845785 5781 }
4526113f 5782 if (r < 0)
842f3b0f 5783 goto finish;
1b9e5b12 5784
88b3300f
LP		 5785 r = dissected_image_load_verity_sig_partition(
5786 dissected_image,
5787 loop->fd,
5788 &arg_verity_settings);
5789 if (r < 0)
5790 goto finish;
5791
8ee9615e
LP		 5792 if (dissected_image->has_verity && !arg_verity_settings.root_hash && !dissected_image->has_verity_sig)
5793 log_notice("Note: image %s contains verity information, but no root hash specified and no embedded "
5794 "root hash signature found! Proceeding without integrity checking.", arg_image);
4623e8e6 5795
89e62e0b
LP		 5796 r = dissected_image_decrypt_interactively(
5797 dissected_image,
5798 NULL,
5799 &arg_verity_settings,
5800 0,
5801 &decrypted_image);
1b9e5b12
LP		 5802 if (r < 0)
5803 goto finish;
0f3be6ca
LP		 5804
5805 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5806 if (remove_image && unlink(arg_image) >= 0)
5807 remove_image = false;
842f3b0f 5808 }
842f3b0f 5809
86c0dd4a 5810 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5a8af538
LP		 5811 if (r < 0)
5812 goto finish;
5813
de40a303
LP		 5814 if (arg_console_mode < 0)
5815 arg_console_mode =
5816 isatty(STDIN_FILENO) > 0 &&
5817 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
9c857b9d 5818
de40a303
LP		 5819 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5820 arg_quiet = true;
a258bf26 5821
9c857b9d
LP		 5822 if (!arg_quiet)
5823 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
5824 arg_machine, arg_image ?: arg_directory);
5825
72c0a2c2 5826 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
a258bf26 5827
66edd963 5828 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
03cfe0d5
LP		 5829 r = log_error_errno(errno, "Failed to become subreaper: %m");
5830 goto finish;
5831 }
5832
761cf19d
FW		 5833 if (arg_expose_ports) {
5834 r = fw_ctx_new(&fw_ctx);
5835 if (r < 0) {
5836 log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
5837 goto finish;
5838 }
5839 expose_args.fw_ctx = fw_ctx;
5840 }
d87be9b0 5841 for (;;) {
3acc84eb 5842 r = run_container(dissected_image,
44dbef90
LP		 5843 secondary,
5844 fds,
5845 veth_name, &veth_created,
761cf19d 5846 &expose_args, &master,
44dbef90 5847 &pid, &ret);
b0067625 5848 if (r <= 0)
d87be9b0 5849 break;
d87be9b0 5850 }
88213476
LP		 5851
5852finish:
04f590a4
LP		 5853 (void) sd_notify(false,
5854 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5855 "STOPPING=1\nSTATUS=Terminating...");
af4ec430 5856
9444b1f2 5857 if (pid > 0)
c67b0082 5858 (void) kill(pid, SIGKILL);
88213476 5859
503546da 5860 /* Try to flush whatever is still queued in the pty */
6a0f896b 5861 if (master >= 0) {
f5fbe71d 5862 (void) copy_bytes(master, STDOUT_FILENO, UINT64_MAX, 0);
6a0f896b
LP		 5863 master = safe_close(master);
5864 }
5865
5866 if (pid > 0)
5867 (void) wait_for_terminate(pid, NULL);
503546da 5868
50ebcf6c
LP		 5869 pager_close();
5870
17cbb288 5871 if (remove_directory && arg_directory) {
ec16945e
LP		 5872 int k;
5873
17cbb288 5874 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
ec16945e 5875 if (k < 0)
17cbb288 5876 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
ec16945e
LP		 5877 }
5878
0f3be6ca
LP		 5879 if (remove_image && arg_image) {
5880 if (unlink(arg_image) < 0)
5881 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5882 }
5883
c67b0082
LP		 5884 if (remove_tmprootdir) {
5885 if (rmdir(tmprootdir) < 0)
5886 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5887 }
5888
785890ac
LP		 5889 if (arg_machine) {
5890 const char *p;
5891
63c372cb 5892 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 5893 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 5894 }
5895
deff68e7
FW		 5896 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET, &expose_args.address4);
5897 expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET6, &expose_args.address6);
7513c5b8
LP		 5898
5899 if (veth_created)
5900 (void) remove_veth_links(veth_name, arg_network_veth_extra);
22b28dfd 5901 (void) remove_bridge(arg_network_zone);
f757855e 5902
f757855e
LP		 5903 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5904 expose_port_free_all(arg_expose_ports);
bf428efb 5905 rlimit_free_all(arg_rlimit);
b2645747 5906 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
3652872a 5907 credential_free_all(arg_credentials, arg_n_credentials);
6d0b55c2 5908
44dbef90
LP		 5909 if (r < 0)
5910 return r;
5911
5912 return ret;
88213476 5913}
44dbef90
LP		 5914
5915DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.