]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #17766 from weblate/weblate-systemd-master
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
88213476 2
349cc4a5 3#if HAVE_BLKID
8fe0087e 4#endif
88213476 5#include <errno.h>
88213476 6#include <getopt.h>
503f480f 7#include <linux/fs.h>
1b9e5b12 8#include <linux/loop.h>
349cc4a5 9#if HAVE_SELINUX
8fe0087e 10#include <selinux/selinux.h>
1b9e5b12 11#endif
8fe0087e 12#include <stdlib.h>
8fe0087e 13#include <sys/file.h>
335d2ead 14#include <sys/ioctl.h>
8fe0087e
LP		 15#include <sys/personality.h>
16#include <sys/prctl.h>
17#include <sys/types.h>
6916b164 18#include <sys/wait.h>
335d2ead 19#include <termios.h>
8fe0087e 20#include <unistd.h>
1b9e5b12 21
b053cd5f 22#include "sd-bus.h"
1f0cd86b 23#include "sd-daemon.h"
1f0cd86b 24#include "sd-id128.h"
8fe0087e 25
b5efdb8a 26#include "alloc-util.h"
8fe0087e
LP		 27#include "barrier.h"
28#include "base-filesystem.h"
29#include "blkid-util.h"
30#include "btrfs-util.h"
b8ea7a6e 31#include "bus-error.h"
b053cd5f 32#include "bus-util.h"
8fe0087e 33#include "cap-list.h"
430f0182 34#include "capability-util.h"
04d391da 35#include "cgroup-util.h"
8fe0087e 36#include "copy.h"
d107bb7d 37#include "cpu-set-util.h"
4fc9982c 38#include "dev-setup.h"
2d845785 39#include "dissect-image.h"
8fe0087e 40#include "env-util.h"
3652872a 41#include "escape.h"
3ffd4af2 42#include "fd-util.h"
842f3b0f 43#include "fdset.h"
a5c32cff 44#include "fileio.h"
f97b34a6 45#include "format-util.h"
f4f15635 46#include "fs-util.h"
1b9e5b12 47#include "gpt.h"
4623e8e6 48#include "hexdecoct.h"
8fe0087e 49#include "hostname-util.h"
910fd145 50#include "id128-util.h"
3652872a 51#include "io-util.h"
8fe0087e 52#include "log.h"
2d845785 53#include "loop-util.h"
8fe0087e 54#include "loopback-setup.h"
1b9cebf6 55#include "machine-image.h"
8fe0087e 56#include "macro.h"
44dbef90 57#include "main-func.h"
f5947a5e 58#include "missing_sched.h"
8fe0087e 59#include "mkdir.h"
4349cd7c 60#include "mount-util.h"
049af8ad 61#include "mountpoint-util.h"
0cb8e3d1 62#include "namespace-util.h"
8fe0087e 63#include "netlink-util.h"
07630cea 64#include "nspawn-cgroup.h"
3652872a 65#include "nspawn-creds.h"
3603efde 66#include "nspawn-def.h"
07630cea
LP		 67#include "nspawn-expose-ports.h"
68#include "nspawn-mount.h"
69#include "nspawn-network.h"
de40a303 70#include "nspawn-oci.h"
7336138e 71#include "nspawn-patch-uid.h"
07630cea 72#include "nspawn-register.h"
910fd145 73#include "nspawn-seccomp.h"
07630cea
LP		 74#include "nspawn-settings.h"
75#include "nspawn-setuid.h"
7732f92b 76#include "nspawn-stub-pid1.h"
d8b4d14d 77#include "nulstr-util.h"
d58ad743 78#include "os-util.h"
50ebcf6c 79#include "pager.h"
6bedfcbb 80#include "parse-util.h"
8fe0087e 81#include "path-util.h"
294bf0c3 82#include "pretty-print.h"
0b452006 83#include "process-util.h"
8fe0087e
LP		 84#include "ptyfwd.h"
85#include "random-util.h"
8869a0b4 86#include "raw-clone.h"
86775e35 87#include "resolve-util.h"
bf428efb 88#include "rlimit-util.h"
8fe0087e 89#include "rm-rf.h"
de40a303
LP		 90#if HAVE_SECCOMP
91#include "seccomp-util.h"
92#endif
68b02049 93#include "selinux-util.h"
8fe0087e 94#include "signal-util.h"
2583fbea 95#include "socket-util.h"
8fcde012 96#include "stat-util.h"
15a5e950 97#include "stdio-util.h"
5c828e66 98#include "string-table.h"
07630cea 99#include "string-util.h"
8fe0087e 100#include "strv.h"
de40a303 101#include "sysctl-util.h"
8fe0087e 102#include "terminal-util.h"
e4de7287 103#include "tmpfile-util.h"
affb60b1 104#include "umask-util.h"
43c3fb46 105#include "unit-name.h"
b1d4f8e1 106#include "user-util.h"
8fe0087e 107#include "util.h"
e9642be2 108
e96ceaba
LP		 109/* The notify socket inside the container it can use to talk to nspawn using the sd_notify(3) protocol */
110#define NSPAWN_NOTIFY_SOCKET_PATH "/run/host/notify"
0e7ac751 111
2a49b612
ZJS		 112#define EXIT_FORCE_RESTART 133
113
113cea80
DH		 114typedef enum ContainerStatus {
115 CONTAINER_TERMINATED,
6145bb4f 116 CONTAINER_REBOOTED,
113cea80
DH		 117} ContainerStatus;
118
88213476 119static char *arg_directory = NULL;
ec16945e 120static char *arg_template = NULL;
5f932eb9 121static char *arg_chdir = NULL;
b53ede69
PW		 122static char *arg_pivot_root_new = NULL;
123static char *arg_pivot_root_old = NULL;
687d0825 124static char *arg_user = NULL;
de40a303
LP		 125static uid_t arg_uid = UID_INVALID;
126static gid_t arg_gid = GID_INVALID;
127static gid_t* arg_supplementary_gids = NULL;
128static size_t arg_n_supplementary_gids = 0;
9444b1f2 129static sd_id128_t arg_uuid = {};
3a9530e5
LP		 130static char *arg_machine = NULL; /* The name used by the host to refer to this */
131static char *arg_hostname = NULL; /* The name the payload sees by default */
c74e630d
LP		 132static const char *arg_selinux_context = NULL;
133static const char *arg_selinux_apifs_context = NULL;
de40a303 134static char *arg_slice = NULL;
ff01d048 135static bool arg_private_network = false;
bc2f673e 136static bool arg_read_only = false;
7732f92b 137static StartMode arg_start_mode = START_PID1;
ec16945e 138static bool arg_ephemeral = false;
57fb9fb5 139static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 140static bool arg_link_journal_try = false;
520e0d54 141static uint64_t arg_caps_retain =
50b52222
LP		 142 (1ULL << CAP_AUDIT_CONTROL) |
143 (1ULL << CAP_AUDIT_WRITE) |
5076f0cc
LP		 144 (1ULL << CAP_CHOWN) |
145 (1ULL << CAP_DAC_OVERRIDE) |
146 (1ULL << CAP_DAC_READ_SEARCH) |
147 (1ULL << CAP_FOWNER) |
148 (1ULL << CAP_FSETID) |
149 (1ULL << CAP_IPC_OWNER) |
150 (1ULL << CAP_KILL) |
151 (1ULL << CAP_LEASE) |
152 (1ULL << CAP_LINUX_IMMUTABLE) |
50b52222 153 (1ULL << CAP_MKNOD) |
5076f0cc
LP		 154 (1ULL << CAP_NET_BIND_SERVICE) |
155 (1ULL << CAP_NET_BROADCAST) |
156 (1ULL << CAP_NET_RAW) |
5076f0cc 157 (1ULL << CAP_SETFCAP) |
50b52222 158 (1ULL << CAP_SETGID) |
5076f0cc
LP		 159 (1ULL << CAP_SETPCAP) |
160 (1ULL << CAP_SETUID) |
161 (1ULL << CAP_SYS_ADMIN) |
50b52222 162 (1ULL << CAP_SYS_BOOT) |
5076f0cc
LP		 163 (1ULL << CAP_SYS_CHROOT) |
164 (1ULL << CAP_SYS_NICE) |
165 (1ULL << CAP_SYS_PTRACE) |
d87be9b0 166 (1ULL << CAP_SYS_RESOURCE) |
50b52222 167 (1ULL << CAP_SYS_TTY_CONFIG);
de40a303 168static CapabilityQuintet arg_full_capabilities = CAPABILITY_QUINTET_NULL;
5a8af538 169static CustomMount *arg_custom_mounts = NULL;
88614c8a 170static size_t arg_n_custom_mounts = 0;
f4889f65 171static char **arg_setenv = NULL;
284c0b91 172static bool arg_quiet = false;
eb91eb18 173static bool arg_register = true;
89f7c846 174static bool arg_keep_unit = false;
aa28aefe 175static char **arg_network_interfaces = NULL;
c74e630d 176static char **arg_network_macvlan = NULL;
4bbfe7ad 177static char **arg_network_ipvlan = NULL;
69c79d3c 178static bool arg_network_veth = false;
f6d6bad1 179static char **arg_network_veth_extra = NULL;
f757855e 180static char *arg_network_bridge = NULL;
22b28dfd 181static char *arg_network_zone = NULL;
d7bea6b6 182static char *arg_network_namespace_path = NULL;
bb068de0 183static PagerFlags arg_pager_flags = 0;
050f7277 184static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 185static char *arg_image = NULL;
de40a303 186static char *arg_oci_bundle = NULL;
f757855e 187static VolatileMode arg_volatile_mode = VOLATILE_NO;
6d0b55c2 188static ExposePort *arg_expose_ports = NULL;
f36933fe 189static char **arg_property = NULL;
de40a303 190static sd_bus_message *arg_property_message = NULL;
0de7acce 191static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
6dac160c 192static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
0de7acce 193static bool arg_userns_chown = false;
c6c8f6e2 194static int arg_kill_signal = 0;
5da38d07 195static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
f757855e
LP		 196static SettingsMask arg_settings_mask = 0;
197static int arg_settings_trusted = -1;
198static char **arg_parameters = NULL;
6aadfa4c 199static const char *arg_container_service_name = "systemd-nspawn";
9c1e04d0 200static bool arg_notify_ready = false;
5a8ff0e6 201static bool arg_use_cgns = true;
0c582db0 202static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
1099ceeb 203static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_TMPFS_TMP;
aee36b4e 204static VeritySettings arg_verity_settings = VERITY_SETTINGS_DEFAULT;
6b000af4
LP		 205static char **arg_syscall_allow_list = NULL;
206static char **arg_syscall_deny_list = NULL;
de40a303
LP		 207#if HAVE_SECCOMP
208static scmp_filter_ctx arg_seccomp = NULL;
209#endif
bf428efb 210static struct rlimit *arg_rlimit[_RLIMIT_MAX] = {};
66edd963 211static bool arg_no_new_privileges = false;
81f345df
LP		 212static int arg_oom_score_adjust = 0;
213static bool arg_oom_score_adjust_set = false;
0985c7c4 214static CPUSet arg_cpu_set = {};
09d423e9 215static ResolvConfMode arg_resolv_conf = RESOLV_CONF_AUTO;
1688841f 216static TimezoneMode arg_timezone = TIMEZONE_AUTO;
de40a303
LP		 217static unsigned arg_console_width = (unsigned) -1, arg_console_height = (unsigned) -1;
218static DeviceNode* arg_extra_nodes = NULL;
219static size_t arg_n_extra_nodes = 0;
220static char **arg_sysctl = NULL;
221static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
3652872a
LP		 222static Credential *arg_credentials = NULL;
223static size_t arg_n_credentials = 0;
88213476 224
6145bb4f
LP		 225STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
226STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
227STATIC_DESTRUCTOR_REGISTER(arg_chdir, freep);
228STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_new, freep);
229STATIC_DESTRUCTOR_REGISTER(arg_pivot_root_old, freep);
230STATIC_DESTRUCTOR_REGISTER(arg_user, freep);
231STATIC_DESTRUCTOR_REGISTER(arg_supplementary_gids, freep);
232STATIC_DESTRUCTOR_REGISTER(arg_machine, freep);
233STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
234STATIC_DESTRUCTOR_REGISTER(arg_slice, freep);
235STATIC_DESTRUCTOR_REGISTER(arg_setenv, strv_freep);
236STATIC_DESTRUCTOR_REGISTER(arg_network_interfaces, strv_freep);
237STATIC_DESTRUCTOR_REGISTER(arg_network_macvlan, strv_freep);
238STATIC_DESTRUCTOR_REGISTER(arg_network_ipvlan, strv_freep);
239STATIC_DESTRUCTOR_REGISTER(arg_network_veth_extra, strv_freep);
240STATIC_DESTRUCTOR_REGISTER(arg_network_bridge, freep);
241STATIC_DESTRUCTOR_REGISTER(arg_network_zone, freep);
242STATIC_DESTRUCTOR_REGISTER(arg_network_namespace_path, freep);
243STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
244STATIC_DESTRUCTOR_REGISTER(arg_oci_bundle, freep);
245STATIC_DESTRUCTOR_REGISTER(arg_property, strv_freep);
246STATIC_DESTRUCTOR_REGISTER(arg_property_message, sd_bus_message_unrefp);
247STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
89e62e0b 248STATIC_DESTRUCTOR_REGISTER(arg_verity_settings, verity_settings_done);
6b000af4
LP		 249STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
250STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
6145bb4f
LP		 251#if HAVE_SECCOMP
252STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
253#endif
0985c7c4 254STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
6145bb4f
LP		 255STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
256
dce66ffe
ZJS		 257static int handle_arg_console(const char *arg) {
258 if (streq(arg, "help")) {
10e8a60b
LP		 259 puts("autopipe\n"
260 "interactive\n"
dce66ffe 261 "passive\n"
10e8a60b
LP		 262 "pipe\n"
263 "read-only");
dce66ffe
ZJS		 264 return 0;
265 }
266
267 if (streq(arg, "interactive"))
268 arg_console_mode = CONSOLE_INTERACTIVE;
269 else if (streq(arg, "read-only"))
270 arg_console_mode = CONSOLE_READ_ONLY;
271 else if (streq(arg, "passive"))
272 arg_console_mode = CONSOLE_PASSIVE;
554c4beb
LP		 273 else if (streq(arg, "pipe")) {
274 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
275 log_full(arg_quiet ? LOG_DEBUG : LOG_NOTICE,
276 "Console mode 'pipe' selected, but standard input/output are connected to an interactive TTY. "
277 "Most likely you want to use 'interactive' console mode for proper interactivity and shell job control. "
278 "Proceeding anyway.");
279
dce66ffe 280 arg_console_mode = CONSOLE_PIPE;
10e8a60b
LP		 281 } else if (streq(arg, "autopipe")) {
282 if (isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0)
283 arg_console_mode = CONSOLE_INTERACTIVE;
284 else
285 arg_console_mode = CONSOLE_PIPE;
554c4beb 286 } else
dce66ffe
ZJS		 287 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown console mode: %s", optarg);
288
289 arg_settings_mask |= SETTING_CONSOLE_MODE;
290 return 1;
291}
292
37ec0fdd
LP		 293static int help(void) {
294 _cleanup_free_ char *link = NULL;
295 int r;
296
bb068de0 297 (void) pager_open(arg_pager_flags);
50ebcf6c 298
37ec0fdd
LP		 299 r = terminal_urlify_man("systemd-nspawn", "1", &link);
300 if (r < 0)
301 return log_oom();
302
25148653 303 printf("%1$s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
37a92352 304 "%5$sSpawn a command or OS in a light-weight container.%6$s\n\n"
a8828ed9
DW		 305 " -h --help Show this help\n"
306 " --version Print version string\n"
69c79d3c 307 " -q --quiet Do not show status information\n"
bb068de0 308 " --no-pager Do not pipe output into a pager\n"
25148653
LP		 309 " --settings=BOOLEAN Load additional settings from .nspawn file\n\n"
310 "%3$sImage:%4$s\n"
1b9e5b12 311 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 312 " --template=PATH Initialize root directory from template directory,\n"
313 " if missing\n"
314 " -x --ephemeral Run container with snapshot of root directory, and\n"
315 " remove it after exit\n"
25e68fd3
LP		 316 " -i --image=PATH Root file system disk image (or device node) for\n"
317 " the container\n"
de40a303 318 " --oci-bundle=PATH OCI bundle directory\n"
25148653
LP		 319 " --read-only Mount the root directory read-only\n"
320 " --volatile[=MODE] Run the system in volatile mode\n"
25e68fd3 321 " --root-hash=HASH Specify verity root hash for root disk image\n"
c2923fdc
LB		 322 " --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity\n"
323 " as a DER encoded PKCS7, either as a path to a file\n"
324 " or as an ASCII base64 encoded string prefixed by\n"
325 " 'base64:'\n"
e7cbe5cb 326 " --verity-data=PATH Specify hash device for verity\n"
25148653
LP		 327 " --pivot-root=PATH[:PATH]\n"
328 " Pivot root to given directory in the container\n\n"
329 "%3$sExecution:%4$s\n"
7732f92b 330 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
a8828ed9 331 " -b --boot Boot up full system (i.e. invoke init)\n"
5f932eb9 332 " --chdir=PATH Set working directory in the container\n"
25148653
LP		 333 " -E --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
334 " -u --user=USER Run the command under specified user or UID\n"
335 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
336 " --notify-ready=BOOLEAN Receive notifications from the child init process\n\n"
337 "%3$sSystem Identity:%4$s\n"
a8828ed9 338 " -M --machine=NAME Set the machine name for the container\n"
3a9530e5 339 " --hostname=NAME Override the hostname for the container\n"
25148653
LP		 340 " --uuid=UUID Set a specific machine UUID for the container\n\n"
341 "%3$sProperties:%4$s\n"
a8828ed9 342 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 343 " --property=NAME=VALUE Set scope unit property\n"
25148653
LP		 344 " --register=BOOLEAN Register container as machine\n"
345 " --keep-unit Do not register a scope for the machine, reuse\n"
346 " the service unit nspawn is running in\n\n"
347 "%3$sUser Namespacing:%4$s\n"
90b4a64d 348 " -U --private-users=pick Run within user namespace, autoselect UID/GID range\n"
03cfe0d5 349 " --private-users[=UIDBASE[:NUIDS]]\n"
90b4a64d 350 " Similar, but with user configured UID/GID range\n"
25148653
LP		 351 " --private-users-chown Adjust OS tree ownership to private UID/GID range\n\n"
352 "%3$sNetworking:%4$s\n"
69c79d3c
LP		 353 " --private-network Disable network in container\n"
354 " --network-interface=INTERFACE\n"
355 " Assign an existing network interface to the\n"
356 " container\n"
c74e630d
LP		 357 " --network-macvlan=INTERFACE\n"
358 " Create a macvlan network interface based on an\n"
359 " existing network interface to the container\n"
4bbfe7ad
TG		 360 " --network-ipvlan=INTERFACE\n"
361 " Create a ipvlan network interface based on an\n"
362 " existing network interface to the container\n"
a8eaaee7 363 " -n --network-veth Add a virtual Ethernet connection between host\n"
69c79d3c 364 " and container\n"
f6d6bad1
LP		 365 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
366 " Add an additional virtual Ethernet link between\n"
367 " host and container\n"
ab046dde 368 " --network-bridge=INTERFACE\n"
90b4a64d
ZJS		 369 " Add a virtual Ethernet connection to the container\n"
370 " and attach it to an existing bridge on the host\n"
371 " --network-zone=NAME Similar, but attach the new interface to an\n"
372 " an automatically managed bridge interface\n"
d7bea6b6
DP		 373 " --network-namespace-path=PATH\n"
374 " Set network namespace to the one represented by\n"
375 " the specified kernel namespace file node\n"
6d0b55c2 376 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
25148653
LP		 377 " Expose a container IP port on the host\n\n"
378 "%3$sSecurity:%4$s\n"
a8828ed9
DW		 379 " --capability=CAP In addition to the default, retain specified\n"
380 " capability\n"
381 " --drop-capability=CAP Drop the specified capability from the default set\n"
f4e803c8 382 " --no-new-privileges Set PR_SET_NO_NEW_PRIVS flag for container payload\n"
960e4569
LP		 383 " --system-call-filter=LIST|~LIST\n"
384 " Permit/prohibit specific system calls\n"
25148653
LP		 385 " -Z --selinux-context=SECLABEL\n"
386 " Set the SELinux security context to be used by\n"
387 " processes in the container\n"
388 " -L --selinux-apifs-context=SECLABEL\n"
389 " Set the SELinux security context to be used by\n"
390 " API/tmpfs file systems in the container\n\n"
391 "%3$sResources:%4$s\n"
bf428efb 392 " --rlimit=NAME=LIMIT Set a resource limit for the payload\n"
81f345df
LP		 393 " --oom-score-adjust=VALUE\n"
394 " Adjust the OOM score value for the payload\n"
f4e803c8
LP		 395 " --cpu-affinity=CPUS Adjust the CPU affinity of the container\n"
396 " --personality=ARCH Pick personality for this container\n\n"
25148653 397 "%3$sIntegration:%4$s\n"
09d423e9 398 " --resolv-conf=MODE Select mode of /etc/resolv.conf initialization\n"
1688841f 399 " --timezone=MODE Select mode of /etc/localtime initialization\n"
25148653
LP		 400 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
401 " host, try-guest, try-host\n"
402 " -j Equivalent to --link-journal=try-guest\n\n"
403 "%3$sMounts:%4$s\n"
5e5bfa6e
EY		 404 " --bind=PATH[:PATH[:OPTIONS]]\n"
405 " Bind mount a file or directory from the host into\n"
a8828ed9 406 " the container\n"
5e5bfa6e
EY		 407 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
408 " Similar, but creates a read-only bind mount\n"
de40a303
LP		 409 " --inaccessible=PATH Over-mount file node with inaccessible node to mask\n"
410 " it\n"
06c17c39 411 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 412 " --overlay=PATH[:PATH...]:PATH\n"
413 " Create an overlay mount from the host to \n"
414 " the container\n"
415 " --overlay-ro=PATH[:PATH...]:PATH\n"
25148653
LP		 416 " Similar, but creates a read-only overlay mount\n\n"
417 "%3$sInput/Output:%4$s\n"
de40a303
LP		 418 " --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
419 " set up for the container.\n"
3652872a
LP		 420 " -P --pipe Equivalent to --console=pipe\n\n"
421 "%3$sCredentials:%4$s\n"
422 " --set-credential=ID:VALUE\n"
423 " Pass a credential with literal value to container.\n"
424 " --load-credential=ID:PATH\n"
425 " Load credential to pass to container from file or\n"
426 " AF_UNIX stream socket.\n"
25148653 427 "\nSee the %2$s for details.\n"
37ec0fdd
LP		 428 , program_invocation_short_name
429 , link
37a92352
LP		 430 , ansi_underline(), ansi_normal()
431 , ansi_highlight(), ansi_normal()
432 );
37ec0fdd
LP		 433
434 return 0;
88213476
LP		 435}
436
86c0dd4a 437static int custom_mount_check_all(void) {
88614c8a 438 size_t i;
5a8af538 439
5a8af538
LP		 440 for (i = 0; i < arg_n_custom_mounts; i++) {
441 CustomMount *m = &arg_custom_mounts[i];
442
0de7acce 443 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
baaa35ad
ZJS		 444 if (arg_userns_chown)
445 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
446 "--private-users-chown may not be combined with custom root mounts.");
447 else if (arg_uid_shift == UID_INVALID)
448 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
449 "--private-users with automatic UID shift may not be combined with custom root mounts.");
825d5287 450 }
5a8af538
LP		 451 }
452
453 return 0;
454}
455
8199d554 456static int detect_unified_cgroup_hierarchy_from_environment(void) {
c78c095b 457 const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
415fc41c 458 int r;
5da38d07 459
efdb0237 460 /* Allow the user to control whether the unified hierarchy is used */
c78c095b
ZJS		 461
462 e = getenv(var);
463 if (!e) {
d5fc5b2f 464 /* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
c78c095b
ZJS		 465 var = "UNIFIED_CGROUP_HIERARCHY";
466 e = getenv(var);
c78c095b
ZJS		 467 }
468
469 if (!isempty(e)) {
efdb0237
LP		 470 r = parse_boolean(e);
471 if (r < 0)
c78c095b 472 return log_error_errno(r, "Failed to parse $%s: %m", var);
5da38d07
TH		 473 if (r > 0)
474 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
475 else
476 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237
LP		 477 }
478
8199d554
LP		 479 return 0;
480}
481
482static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
483 int r;
484
75b0d8b8
ZJS		 485 /* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
486 * in the image actually supports. */
b4cccbc1
LP		 487 r = cg_all_unified();
488 if (r < 0)
489 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
490 if (r > 0) {
a8725a06
ZJS		 491 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
492 * routine only detects 231, so we'll have a false negative here for 230. */
493 r = systemd_installation_has_version(directory, 230);
494 if (r < 0)
495 return log_error_errno(r, "Failed to determine systemd version in container: %m");
496 if (r > 0)
497 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
498 else
499 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
c22800e4 500 } else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2977724b
TH		 501 /* Mixed cgroup hierarchy support was added in 233 */
502 r = systemd_installation_has_version(directory, 233);
0fd9563f
ZJS		 503 if (r < 0)
504 return log_error_errno(r, "Failed to determine systemd version in container: %m");
505 if (r > 0)
506 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
507 else
508 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
509 } else
5da38d07 510 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 511
8199d554
LP		 512 log_debug("Using %s hierarchy for container.",
513 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
514 arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
515
efdb0237
LP		 516 return 0;
517}
518
8a99bd0c
ZJS		 519static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
520 uint64_t mask = 0;
521 int r;
522
523 for (;;) {
524 _cleanup_free_ char *t = NULL;
525
526 r = extract_first_word(&spec, &t, ",", 0);
527 if (r < 0)
528 return log_error_errno(r, "Failed to parse capability %s.", t);
529 if (r == 0)
530 break;
531
532 if (streq(t, "help")) {
533 for (int i = 0; i < capability_list_length(); i++) {
534 const char *name;
535
536 name = capability_to_name(i);
537 if (name)
538 puts(name);
539 }
540
541 return 0; /* quit */
542 }
543
544 if (streq(t, "all"))
545 mask = (uint64_t) -1;
546 else {
547 r = capability_from_name(t);
548 if (r < 0)
549 return log_error_errno(r, "Failed to parse capability %s.", t);
550
551 mask |= 1ULL << r;
552 }
553 }
554
555 *ret_mask = mask;
556 return 1; /* continue */
557}
558
49048684 559static int parse_share_ns_env(const char *name, unsigned long ns_flag) {
0c582db0
LB		 560 int r;
561
562 r = getenv_bool(name);
563 if (r == -ENXIO)
49048684 564 return 0;
0c582db0 565 if (r < 0)
49048684 566 return log_error_errno(r, "Failed to parse $%s: %m", name);
de40a303 567
0c582db0 568 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
de40a303 569 arg_settings_mask |= SETTING_CLONE_NS_FLAGS;
49048684 570 return 0;
0c582db0
LB		 571}
572
49048684 573static int parse_mount_settings_env(void) {
4f086aab 574 const char *e;
1099ceeb
LP		 575 int r;
576
577 r = getenv_bool("SYSTEMD_NSPAWN_TMPFS_TMP");
49048684
ZJS		 578 if (r < 0 && r != -ENXIO)
579 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_TMPFS_TMP: %m");
1099ceeb
LP		 580 if (r >= 0)
581 SET_FLAG(arg_mount_settings, MOUNT_APPLY_TMPFS_TMP, r > 0);
4f086aab
SU		 582
583 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
49048684 584 if (streq_ptr(e, "network"))
4f086aab 585 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
4f086aab 586
49048684
ZJS		 587 else if (e) {
588 r = parse_boolean(e);
589 if (r < 0)
590 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_API_VFS_WRITABLE: %m");
591
592 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_RO, r == 0);
593 SET_FLAG(arg_mount_settings, MOUNT_APPLY_APIVFS_NETNS, false);
ab8ee0f2 594 }
4f086aab 595
49048684 596 return 0;
4f086aab
SU		 597}
598
49048684 599static int parse_environment(void) {
d5455d2f
LP		 600 const char *e;
601 int r;
602
49048684
ZJS		 603 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
604 if (r < 0)
605 return r;
606 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
607 if (r < 0)
608 return r;
609 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
610 if (r < 0)
611 return r;
612 r = parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
613 if (r < 0)
614 return r;
d5455d2f 615
49048684
ZJS		 616 r = parse_mount_settings_env();
617 if (r < 0)
618 return r;
d5455d2f 619
489fae52
ZJS		 620 /* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
621 * even if it is supported. If not supported, it has no effect. */
de40a303 622 if (!cg_ns_supported())
489fae52 623 arg_use_cgns = false;
de40a303
LP		 624 else {
625 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
626 if (r < 0) {
627 if (r != -ENXIO)
49048684 628 return log_error_errno(r, "Failed to parse $SYSTEMD_NSPAWN_USE_CGNS: %m");
de40a303
LP		 629
630 arg_use_cgns = true;
631 } else {
632 arg_use_cgns = r > 0;
633 arg_settings_mask |= SETTING_USE_CGNS;
634 }
635 }
d5455d2f
LP		 636
637 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
638 if (e)
639 arg_container_service_name = e;
640
49048684 641 return detect_unified_cgroup_hierarchy_from_environment();
d5455d2f
LP		 642}
643
88213476 644static int parse_argv(int argc, char *argv[]) {
a41fe3a2 645 enum {
acbeb427
ZJS		 646 ARG_VERSION = 0x100,
647 ARG_PRIVATE_NETWORK,
bc2f673e 648 ARG_UUID,
5076f0cc 649 ARG_READ_ONLY,
57fb9fb5 650 ARG_CAPABILITY,
420c7379 651 ARG_DROP_CAPABILITY,
17fe0523
LP		 652 ARG_LINK_JOURNAL,
653 ARG_BIND,
f4889f65 654 ARG_BIND_RO,
06c17c39 655 ARG_TMPFS,
5a8af538
LP		 656 ARG_OVERLAY,
657 ARG_OVERLAY_RO,
de40a303 658 ARG_INACCESSIBLE,
eb91eb18 659 ARG_SHARE_SYSTEM,
89f7c846 660 ARG_REGISTER,
aa28aefe 661 ARG_KEEP_UNIT,
69c79d3c 662 ARG_NETWORK_INTERFACE,
c74e630d 663 ARG_NETWORK_MACVLAN,
4bbfe7ad 664 ARG_NETWORK_IPVLAN,
ab046dde 665 ARG_NETWORK_BRIDGE,
22b28dfd 666 ARG_NETWORK_ZONE,
f6d6bad1 667 ARG_NETWORK_VETH_EXTRA,
d7bea6b6 668 ARG_NETWORK_NAMESPACE_PATH,
6afc95b7 669 ARG_PERSONALITY,
4d9f07b4 670 ARG_VOLATILE,
ec16945e 671 ARG_TEMPLATE,
f36933fe 672 ARG_PROPERTY,
6dac160c 673 ARG_PRIVATE_USERS,
c6c8f6e2 674 ARG_KILL_SIGNAL,
f757855e 675 ARG_SETTINGS,
5f932eb9 676 ARG_CHDIR,
b53ede69 677 ARG_PIVOT_ROOT,
7336138e 678 ARG_PRIVATE_USERS_CHOWN,
9c1e04d0 679 ARG_NOTIFY_READY,
4623e8e6 680 ARG_ROOT_HASH,
89e62e0b
LP		 681 ARG_ROOT_HASH_SIG,
682 ARG_VERITY_DATA,
960e4569 683 ARG_SYSTEM_CALL_FILTER,
bf428efb 684 ARG_RLIMIT,
3a9530e5 685 ARG_HOSTNAME,
66edd963 686 ARG_NO_NEW_PRIVILEGES,
81f345df 687 ARG_OOM_SCORE_ADJUST,
d107bb7d 688 ARG_CPU_AFFINITY,
09d423e9 689 ARG_RESOLV_CONF,
1688841f 690 ARG_TIMEZONE,
de40a303
LP		 691 ARG_CONSOLE,
692 ARG_PIPE,
693 ARG_OCI_BUNDLE,
bb068de0 694 ARG_NO_PAGER,
3652872a
LP		 695 ARG_SET_CREDENTIAL,
696 ARG_LOAD_CREDENTIAL,
a41fe3a2
LP		 697 };
698
88213476 699 static const struct option options[] = {
d7bea6b6
DP		 700 { "help", no_argument, NULL, 'h' },
701 { "version", no_argument, NULL, ARG_VERSION },
702 { "directory", required_argument, NULL, 'D' },
703 { "template", required_argument, NULL, ARG_TEMPLATE },
704 { "ephemeral", no_argument, NULL, 'x' },
705 { "user", required_argument, NULL, 'u' },
706 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
707 { "as-pid2", no_argument, NULL, 'a' },
708 { "boot", no_argument, NULL, 'b' },
709 { "uuid", required_argument, NULL, ARG_UUID },
710 { "read-only", no_argument, NULL, ARG_READ_ONLY },
711 { "capability", required_argument, NULL, ARG_CAPABILITY },
712 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
66edd963 713 { "no-new-privileges", required_argument, NULL, ARG_NO_NEW_PRIVILEGES },
d7bea6b6
DP		 714 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
715 { "bind", required_argument, NULL, ARG_BIND },
716 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
717 { "tmpfs", required_argument, NULL, ARG_TMPFS },
718 { "overlay", required_argument, NULL, ARG_OVERLAY },
719 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
de40a303 720 { "inaccessible", required_argument, NULL, ARG_INACCESSIBLE },
d7bea6b6 721 { "machine", required_argument, NULL, 'M' },
3a9530e5 722 { "hostname", required_argument, NULL, ARG_HOSTNAME },
d7bea6b6
DP		 723 { "slice", required_argument, NULL, 'S' },
724 { "setenv", required_argument, NULL, 'E' },
725 { "selinux-context", required_argument, NULL, 'Z' },
726 { "selinux-apifs-context", required_argument, NULL, 'L' },
727 { "quiet", no_argument, NULL, 'q' },
728 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
729 { "register", required_argument, NULL, ARG_REGISTER },
730 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
731 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
732 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
733 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
734 { "network-veth", no_argument, NULL, 'n' },
735 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
736 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
737 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
738 { "network-namespace-path", required_argument, NULL, ARG_NETWORK_NAMESPACE_PATH },
739 { "personality", required_argument, NULL, ARG_PERSONALITY },
740 { "image", required_argument, NULL, 'i' },
741 { "volatile", optional_argument, NULL, ARG_VOLATILE },
742 { "port", required_argument, NULL, 'p' },
743 { "property", required_argument, NULL, ARG_PROPERTY },
744 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
745 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN },
746 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
747 { "settings", required_argument, NULL, ARG_SETTINGS },
748 { "chdir", required_argument, NULL, ARG_CHDIR },
749 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
750 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
751 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
89e62e0b
LP		 752 { "root-hash-sig", required_argument, NULL, ARG_ROOT_HASH_SIG },
753 { "verity-data", required_argument, NULL, ARG_VERITY_DATA },
d7bea6b6 754 { "system-call-filter", required_argument, NULL, ARG_SYSTEM_CALL_FILTER },
bf428efb 755 { "rlimit", required_argument, NULL, ARG_RLIMIT },
81f345df 756 { "oom-score-adjust", required_argument, NULL, ARG_OOM_SCORE_ADJUST },
d107bb7d 757 { "cpu-affinity", required_argument, NULL, ARG_CPU_AFFINITY },
09d423e9 758 { "resolv-conf", required_argument, NULL, ARG_RESOLV_CONF },
1688841f 759 { "timezone", required_argument, NULL, ARG_TIMEZONE },
de40a303
LP		 760 { "console", required_argument, NULL, ARG_CONSOLE },
761 { "pipe", no_argument, NULL, ARG_PIPE },
762 { "oci-bundle", required_argument, NULL, ARG_OCI_BUNDLE },
bb068de0 763 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
3652872a
LP		 764 { "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
765 { "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
eb9da376 766 {}
88213476
LP		 767 };
768
9444b1f2 769 int c, r;
a42c8b54 770 uint64_t plus = 0, minus = 0;
f757855e 771 bool mask_all_settings = false, mask_no_settings = false;
88213476
LP		 772
773 assert(argc >= 0);
774 assert(argv);
775
de40a303 776 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:P", options, NULL)) >= 0)
88213476
LP		 777 switch (c) {
778
779 case 'h':
37ec0fdd 780 return help();
88213476 781
acbeb427 782 case ARG_VERSION:
3f6fd1ba 783 return version();
acbeb427 784
88213476 785 case 'D':
0f03c2a4 786 r = parse_path_argument_and_warn(optarg, false, &arg_directory);
ec16945e 787 if (r < 0)
0f03c2a4 788 return r;
de40a303
LP		 789
790 arg_settings_mask |= SETTING_DIRECTORY;
ec16945e
LP		 791 break;
792
793 case ARG_TEMPLATE:
0f03c2a4 794 r = parse_path_argument_and_warn(optarg, false, &arg_template);
ec16945e 795 if (r < 0)
0f03c2a4 796 return r;
de40a303
LP		 797
798 arg_settings_mask |= SETTING_DIRECTORY;
88213476
LP		 799 break;
800
1b9e5b12 801 case 'i':
0f03c2a4 802 r = parse_path_argument_and_warn(optarg, false, &arg_image);
ec16945e 803 if (r < 0)
0f03c2a4 804 return r;
de40a303
LP		 805
806 arg_settings_mask |= SETTING_DIRECTORY;
807 break;
808
809 case ARG_OCI_BUNDLE:
810 r = parse_path_argument_and_warn(optarg, false, &arg_oci_bundle);
811 if (r < 0)
812 return r;
813
ec16945e
LP		 814 break;
815
816 case 'x':
817 arg_ephemeral = true;
a2f577fc 818 arg_settings_mask |= SETTING_EPHEMERAL;
1b9e5b12
LP		 819 break;
820
687d0825 821 case 'u':
2fc09a9c
DM		 822 r = free_and_strdup(&arg_user, optarg);
823 if (r < 0)
7027ff61 824 return log_oom();
687d0825 825
f757855e 826 arg_settings_mask |= SETTING_USER;
687d0825
MV		 827 break;
828
22b28dfd
LP		 829 case ARG_NETWORK_ZONE: {
830 char *j;
831
b910cc72 832 j = strjoin("vz-", optarg);
22b28dfd
LP		 833 if (!j)
834 return log_oom();
835
836 if (!ifname_valid(j)) {
837 log_error("Network zone name not valid: %s", j);
838 free(j);
839 return -EINVAL;
840 }
841
df1fac6d 842 free_and_replace(arg_network_zone, j);
22b28dfd
LP		 843
844 arg_network_veth = true;
845 arg_private_network = true;
846 arg_settings_mask |= SETTING_NETWORK;
847 break;
848 }
849
ab046dde 850 case ARG_NETWORK_BRIDGE:
ef76dff2 851
baaa35ad
ZJS		 852 if (!ifname_valid(optarg))
853 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
854 "Bridge interface name not valid: %s", optarg);
ef76dff2 855
f757855e
LP		 856 r = free_and_strdup(&arg_network_bridge, optarg);
857 if (r < 0)
858 return log_oom();
ab046dde 859
4831981d 860 _fallthrough_;
0dfaa006 861 case 'n':
69c79d3c
LP		 862 arg_network_veth = true;
863 arg_private_network = true;
f757855e 864 arg_settings_mask |= SETTING_NETWORK;
69c79d3c
LP		 865 break;
866
f6d6bad1
LP		 867 case ARG_NETWORK_VETH_EXTRA:
868 r = veth_extra_parse(&arg_network_veth_extra, optarg);
869 if (r < 0)
870 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
871
872 arg_private_network = true;
873 arg_settings_mask |= SETTING_NETWORK;
874 break;
875
aa28aefe 876 case ARG_NETWORK_INTERFACE:
baaa35ad
ZJS		 877 if (!ifname_valid(optarg))
878 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
879 "Network interface name not valid: %s", optarg);
ef76dff2 880
b390f178
DDM		 881 r = test_network_interface_initialized(optarg);
882 if (r < 0)
883 return r;
884
c74e630d
LP		 885 if (strv_extend(&arg_network_interfaces, optarg) < 0)
886 return log_oom();
887
888 arg_private_network = true;
f757855e 889 arg_settings_mask |= SETTING_NETWORK;
c74e630d
LP		 890 break;
891
892 case ARG_NETWORK_MACVLAN:
ef76dff2 893
baaa35ad
ZJS		 894 if (!ifname_valid(optarg))
895 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
896 "MACVLAN network interface name not valid: %s", optarg);
ef76dff2 897
b390f178
DDM		 898 r = test_network_interface_initialized(optarg);
899 if (r < 0)
900 return r;
901
c74e630d 902 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 903 return log_oom();
904
4bbfe7ad 905 arg_private_network = true;
f757855e 906 arg_settings_mask |= SETTING_NETWORK;
4bbfe7ad
TG		 907 break;
908
909 case ARG_NETWORK_IPVLAN:
ef76dff2 910
baaa35ad
ZJS		 911 if (!ifname_valid(optarg))
912 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
913 "IPVLAN network interface name not valid: %s", optarg);
ef76dff2 914
b390f178
DDM		 915 r = test_network_interface_initialized(optarg);
916 if (r < 0)
917 return r;
918
4bbfe7ad
TG		 919 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
920 return log_oom();
921
4831981d 922 _fallthrough_;
ff01d048
LP		 923 case ARG_PRIVATE_NETWORK:
924 arg_private_network = true;
f757855e 925 arg_settings_mask |= SETTING_NETWORK;
a41fe3a2
LP		 926 break;
927
d7bea6b6
DP		 928 case ARG_NETWORK_NAMESPACE_PATH:
929 r = parse_path_argument_and_warn(optarg, false, &arg_network_namespace_path);
930 if (r < 0)
931 return r;
932
de40a303 933 arg_settings_mask |= SETTING_NETWORK;
d7bea6b6
DP		 934 break;
935
0f0dbc46 936 case 'b':
baaa35ad
ZJS		 937 if (arg_start_mode == START_PID2)
938 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
939 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 940
941 arg_start_mode = START_BOOT;
942 arg_settings_mask |= SETTING_START_MODE;
943 break;
944
945 case 'a':
baaa35ad
ZJS		 946 if (arg_start_mode == START_BOOT)
947 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
948 "--boot and --as-pid2 may not be combined.");
7732f92b
LP		 949
950 arg_start_mode = START_PID2;
951 arg_settings_mask |= SETTING_START_MODE;
0f0dbc46
LP		 952 break;
953
144f0fc0 954 case ARG_UUID:
9444b1f2 955 r = sd_id128_from_string(optarg, &arg_uuid);
317feb4d
LP		 956 if (r < 0)
957 return log_error_errno(r, "Invalid UUID: %s", optarg);
958
baaa35ad
ZJS		 959 if (sd_id128_is_null(arg_uuid))
960 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
961 "Machine UUID may not be all zeroes.");
f757855e
LP		 962
963 arg_settings_mask |= SETTING_MACHINE_ID;
9444b1f2 964 break;
aa96c6cb 965
43c3fb46
LP		 966 case 'S': {
967 _cleanup_free_ char *mangled = NULL;
968
969 r = unit_name_mangle_with_suffix(optarg, NULL, UNIT_NAME_MANGLE_WARN, ".slice", &mangled);
de40a303
LP		 970 if (r < 0)
971 return log_oom();
972
43c3fb46 973 free_and_replace(arg_slice, mangled);
de40a303 974 arg_settings_mask |= SETTING_SLICE;
144f0fc0 975 break;
43c3fb46 976 }
144f0fc0 977
7027ff61 978 case 'M':
c1521918 979 if (isempty(optarg))
97b11eed 980 arg_machine = mfree(arg_machine);
c1521918 981 else {
baaa35ad
ZJS		 982 if (!machine_name_is_valid(optarg))
983 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
984 "Invalid machine name: %s", optarg);
7027ff61 985
0c3c4284
LP		 986 r = free_and_strdup(&arg_machine, optarg);
987 if (r < 0)
eb91eb18 988 return log_oom();
eb91eb18 989 }
9ce6d1b3 990 break;
7027ff61 991
3a9530e5
LP		 992 case ARG_HOSTNAME:
993 if (isempty(optarg))
994 arg_hostname = mfree(arg_hostname);
995 else {
baaa35ad
ZJS		 996 if (!hostname_is_valid(optarg, false))
997 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
998 "Invalid hostname: %s", optarg);
3a9530e5
LP		 999
1000 r = free_and_strdup(&arg_hostname, optarg);
1001 if (r < 0)
1002 return log_oom();
1003 }
1004
1005 arg_settings_mask |= SETTING_HOSTNAME;
1006 break;
1007
82adf6af
LP		 1008 case 'Z':
1009 arg_selinux_context = optarg;
a8828ed9
DW		 1010 break;
1011
82adf6af
LP		 1012 case 'L':
1013 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 1014 break;
1015
bc2f673e
LP		 1016 case ARG_READ_ONLY:
1017 arg_read_only = true;
f757855e 1018 arg_settings_mask |= SETTING_READ_ONLY;
bc2f673e
LP		 1019 break;
1020
420c7379
LP		 1021 case ARG_CAPABILITY:
1022 case ARG_DROP_CAPABILITY: {
8a99bd0c
ZJS		 1023 uint64_t m;
1024 r = parse_capability_spec(optarg, &m);
1025 if (r <= 0)
1026 return r;
5076f0cc 1027
8a99bd0c
ZJS		 1028 if (c == ARG_CAPABILITY)
1029 plus |= m;
1030 else
1031 minus |= m;
f757855e 1032 arg_settings_mask |= SETTING_CAPABILITY;
5076f0cc
LP		 1033 break;
1034 }
66edd963
LP		 1035 case ARG_NO_NEW_PRIVILEGES:
1036 r = parse_boolean(optarg);
1037 if (r < 0)
1038 return log_error_errno(r, "Failed to parse --no-new-privileges= argument: %s", optarg);
1039
1040 arg_no_new_privileges = r;
1041 arg_settings_mask |= SETTING_NO_NEW_PRIVILEGES;
1042 break;
1043
57fb9fb5
LP		 1044 case 'j':
1045 arg_link_journal = LINK_GUEST;
574edc90 1046 arg_link_journal_try = true;
4e1d6aa9 1047 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1048 break;
1049
1050 case ARG_LINK_JOURNAL:
4e1d6aa9 1051 r = parse_link_journal(optarg, &arg_link_journal, &arg_link_journal_try);
c6147113
LP		 1052 if (r < 0)
1053 return log_error_errno(r, "Failed to parse link journal mode %s", optarg);
57fb9fb5 1054
4e1d6aa9 1055 arg_settings_mask |= SETTING_LINK_JOURNAL;
57fb9fb5
LP		 1056 break;
1057
17fe0523 1058 case ARG_BIND:
f757855e
LP		 1059 case ARG_BIND_RO:
1060 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
1061 if (r < 0)
1062 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
17fe0523 1063
f757855e 1064 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
17fe0523 1065 break;
06c17c39 1066
f757855e
LP		 1067 case ARG_TMPFS:
1068 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1069 if (r < 0)
1070 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
5a8af538 1071
f757855e 1072 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
5a8af538 1073 break;
5a8af538
LP		 1074
1075 case ARG_OVERLAY:
ad85779a
LP		 1076 case ARG_OVERLAY_RO:
1077 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
1078 if (r == -EADDRNOTAVAIL)
1079 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
1080 if (r < 0)
1081 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
06c17c39 1082
f757855e 1083 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
06c17c39 1084 break;
06c17c39 1085
de40a303
LP		 1086 case ARG_INACCESSIBLE:
1087 r = inaccessible_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
1088 if (r < 0)
1089 return log_error_errno(r, "Failed to parse --inaccessible= argument %s: %m", optarg);
1090
1091 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
1092 break;
1093
a5f1cb3b 1094 case 'E': {
f4889f65
LP		 1095 char **n;
1096
baaa35ad
ZJS		 1097 if (!env_assignment_is_valid(optarg))
1098 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1099 "Environment variable assignment '%s' is not valid.", optarg);
f4889f65
LP		 1100
1101 n = strv_env_set(arg_setenv, optarg);
1102 if (!n)
1103 return log_oom();
1104
130d3d22 1105 strv_free_and_replace(arg_setenv, n);
f757855e 1106 arg_settings_mask |= SETTING_ENVIRONMENT;
f4889f65
LP		 1107 break;
1108 }
1109
284c0b91
LP		 1110 case 'q':
1111 arg_quiet = true;
1112 break;
1113
8a96d94e 1114 case ARG_SHARE_SYSTEM:
a6b5216c 1115 /* We don't officially support this anymore, except for compat reasons. People should use the
0c582db0 1116 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
63d1c29f 1117 log_warning("Please do not use --share-system anymore, use $SYSTEMD_NSPAWN_SHARE_* instead.");
0c582db0 1118 arg_clone_ns_flags = 0;
8a96d94e
LP		 1119 break;
1120
eb91eb18
LP		 1121 case ARG_REGISTER:
1122 r = parse_boolean(optarg);
1123 if (r < 0) {
1124 log_error("Failed to parse --register= argument: %s", optarg);
1125 return r;
1126 }
1127
1128 arg_register = r;
1129 break;
1130
89f7c846
LP		 1131 case ARG_KEEP_UNIT:
1132 arg_keep_unit = true;
1133 break;
1134
6afc95b7
LP		 1135 case ARG_PERSONALITY:
1136
ac45f971 1137 arg_personality = personality_from_string(optarg);
baaa35ad
ZJS		 1138 if (arg_personality == PERSONALITY_INVALID)
1139 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1140 "Unknown or unsupported personality '%s'.", optarg);
6afc95b7 1141
f757855e 1142 arg_settings_mask |= SETTING_PERSONALITY;
6afc95b7
LP		 1143 break;
1144
4d9f07b4
LP		 1145 case ARG_VOLATILE:
1146
1147 if (!optarg)
f757855e 1148 arg_volatile_mode = VOLATILE_YES;
5c828e66
LP		 1149 else if (streq(optarg, "help")) {
1150 DUMP_STRING_TABLE(volatile_mode, VolatileMode, _VOLATILE_MODE_MAX);
1151 return 0;
1152 } else {
f757855e 1153 VolatileMode m;
4d9f07b4 1154
f757855e 1155 m = volatile_mode_from_string(optarg);
baaa35ad
ZJS		 1156 if (m < 0)
1157 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1158 "Failed to parse --volatile= argument: %s", optarg);
1159 else
f757855e 1160 arg_volatile_mode = m;
6d0b55c2
LP		 1161 }
1162
f757855e
LP		 1163 arg_settings_mask |= SETTING_VOLATILE_MODE;
1164 break;
6d0b55c2 1165
f757855e
LP		 1166 case 'p':
1167 r = expose_port_parse(&arg_expose_ports, optarg);
1168 if (r == -EEXIST)
1169 return log_error_errno(r, "Duplicate port specification: %s", optarg);
1170 if (r < 0)
1171 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
6d0b55c2 1172
f757855e 1173 arg_settings_mask |= SETTING_EXPOSE_PORTS;
6d0b55c2 1174 break;
6d0b55c2 1175
f36933fe
LP		 1176 case ARG_PROPERTY:
1177 if (strv_extend(&arg_property, optarg) < 0)
1178 return log_oom();
1179
1180 break;
1181
ae209204
ZJS		 1182 case ARG_PRIVATE_USERS: {
1183 int boolean = -1;
0de7acce 1184
ae209204
ZJS		 1185 if (!optarg)
1186 boolean = true;
1187 else if (!in_charset(optarg, DIGITS))
1188 /* do *not* parse numbers as booleans */
1189 boolean = parse_boolean(optarg);
1190
1191 if (boolean == false) {
0de7acce
LP		 1192 /* no: User namespacing off */
1193 arg_userns_mode = USER_NAMESPACE_NO;
1194 arg_uid_shift = UID_INVALID;
1195 arg_uid_range = UINT32_C(0x10000);
ae209204 1196 } else if (boolean == true) {
0de7acce
LP		 1197 /* yes: User namespacing on, UID range is read from root dir */
1198 arg_userns_mode = USER_NAMESPACE_FIXED;
1199 arg_uid_shift = UID_INVALID;
1200 arg_uid_range = UINT32_C(0x10000);
1201 } else if (streq(optarg, "pick")) {
1202 /* pick: User namespacing on, UID range is picked randomly */
1203 arg_userns_mode = USER_NAMESPACE_PICK;
1204 arg_uid_shift = UID_INVALID;
1205 arg_uid_range = UINT32_C(0x10000);
1206 } else {
6c2058b3 1207 _cleanup_free_ char *buffer = NULL;
6dac160c
LP		 1208 const char *range, *shift;
1209
0de7acce
LP		 1210 /* anything else: User namespacing on, UID range is explicitly configured */
1211
6dac160c
LP		 1212 range = strchr(optarg, ':');
1213 if (range) {
6c2058b3
ZJS		 1214 buffer = strndup(optarg, range - optarg);
1215 if (!buffer)
1216 return log_oom();
1217 shift = buffer;
6dac160c
LP		 1218
1219 range++;
bfd292ec
ZJS		 1220 r = safe_atou32(range, &arg_uid_range);
1221 if (r < 0)
be715731 1222 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
6dac160c
LP		 1223 } else
1224 shift = optarg;
1225
be715731
ZJS		 1226 r = parse_uid(shift, &arg_uid_shift);
1227 if (r < 0)
1228 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
0de7acce
LP		 1229
1230 arg_userns_mode = USER_NAMESPACE_FIXED;
6dac160c
LP		 1231 }
1232
baaa35ad
ZJS		 1233 if (arg_uid_range <= 0)
1234 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1235 "UID range cannot be 0.");
be715731 1236
0de7acce 1237 arg_settings_mask |= SETTING_USERNS;
6dac160c 1238 break;
ae209204 1239 }
6dac160c 1240
0de7acce 1241 case 'U':
ccabee0d
LP		 1242 if (userns_supported()) {
1243 arg_userns_mode = USER_NAMESPACE_PICK;
1244 arg_uid_shift = UID_INVALID;
1245 arg_uid_range = UINT32_C(0x10000);
1246
1247 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1248 }
1249
7336138e
LP		 1250 break;
1251
0de7acce 1252 case ARG_PRIVATE_USERS_CHOWN:
19aac838 1253 arg_userns_chown = true;
0de7acce
LP		 1254
1255 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 1256 break;
1257
c6c8f6e2 1258 case ARG_KILL_SIGNAL:
5c828e66
LP		 1259 if (streq(optarg, "help")) {
1260 DUMP_STRING_TABLE(signal, int, _NSIG);
1261 return 0;
1262 }
1263
29a3db75 1264 arg_kill_signal = signal_from_string(optarg);
baaa35ad
ZJS		 1265 if (arg_kill_signal < 0)
1266 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1267 "Cannot parse signal: %s", optarg);
c6c8f6e2 1268
f757855e
LP		 1269 arg_settings_mask |= SETTING_KILL_SIGNAL;
1270 break;
1271
1272 case ARG_SETTINGS:
1273
1274 /* no → do not read files
1275 * yes → read files, do not override cmdline, trust only subset
1276 * override → read files, override cmdline, trust only subset
1277 * trusted → read files, do not override cmdline, trust all
1278 */
1279
1280 r = parse_boolean(optarg);
1281 if (r < 0) {
1282 if (streq(optarg, "trusted")) {
1283 mask_all_settings = false;
1284 mask_no_settings = false;
1285 arg_settings_trusted = true;
1286
1287 } else if (streq(optarg, "override")) {
1288 mask_all_settings = false;
1289 mask_no_settings = true;
1290 arg_settings_trusted = -1;
1291 } else
1292 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
1293 } else if (r > 0) {
1294 /* yes */
1295 mask_all_settings = false;
1296 mask_no_settings = false;
1297 arg_settings_trusted = -1;
1298 } else {
1299 /* no */
1300 mask_all_settings = true;
1301 mask_no_settings = false;
1302 arg_settings_trusted = false;
1303 }
1304
c6c8f6e2
LP		 1305 break;
1306
5f932eb9 1307 case ARG_CHDIR:
baaa35ad
ZJS		 1308 if (!path_is_absolute(optarg))
1309 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1310 "Working directory %s is not an absolute path.", optarg);
5f932eb9
LP		 1311
1312 r = free_and_strdup(&arg_chdir, optarg);
1313 if (r < 0)
1314 return log_oom();
1315
1316 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1317 break;
1318
b53ede69
PW		 1319 case ARG_PIVOT_ROOT:
1320 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1321 if (r < 0)
1322 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1323
1324 arg_settings_mask |= SETTING_PIVOT_ROOT;
1325 break;
1326
9c1e04d0
AP		 1327 case ARG_NOTIFY_READY:
1328 r = parse_boolean(optarg);
baaa35ad
ZJS		 1329 if (r < 0)
1330 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1331 "%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
9c1e04d0
AP		 1332 arg_notify_ready = r;
1333 arg_settings_mask |= SETTING_NOTIFY_READY;
1334 break;
1335
4623e8e6 1336 case ARG_ROOT_HASH: {
89e62e0b 1337 _cleanup_free_ void *k = NULL;
4623e8e6
LP		 1338 size_t l;
1339
1340 r = unhexmem(optarg, strlen(optarg), &k, &l);
1341 if (r < 0)
1342 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
89e62e0b 1343 if (l < sizeof(sd_id128_t))
c6147113 1344 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Root hash must be at least 128bit long: %s", optarg);
4623e8e6 1345
89e62e0b
LP		 1346 free_and_replace(arg_verity_settings.root_hash, k);
1347 arg_verity_settings.root_hash_size = l;
4623e8e6
LP		 1348 break;
1349 }
1350
c2923fdc
LB		 1351 case ARG_ROOT_HASH_SIG: {
1352 char *value;
89e62e0b
LP		 1353 size_t l;
1354 void *p;
c2923fdc
LB		 1355
1356 if ((value = startswith(optarg, "base64:"))) {
c2923fdc
LB		 1357 r = unbase64mem(value, strlen(value), &p, &l);
1358 if (r < 0)
1359 return log_error_errno(r, "Failed to parse root hash signature '%s': %m", optarg);
1360
c2923fdc 1361 } else {
89e62e0b 1362 r = read_full_file(optarg, (char**) &p, &l);
c2923fdc 1363 if (r < 0)
89e62e0b 1364 return log_error_errno(r, "Failed parse root hash signature file '%s': %m", optarg);
c2923fdc
LB		 1365 }
1366
89e62e0b
LP		 1367 free_and_replace(arg_verity_settings.root_hash_sig, p);
1368 arg_verity_settings.root_hash_sig_size = l;
c2923fdc
LB		 1369 break;
1370 }
1371
89e62e0b
LP		 1372 case ARG_VERITY_DATA:
1373 r = parse_path_argument_and_warn(optarg, false, &arg_verity_settings.data_path);
1374 if (r < 0)
1375 return r;
1376 break;
1377
960e4569
LP		 1378 case ARG_SYSTEM_CALL_FILTER: {
1379 bool negative;
1380 const char *items;
1381
1382 negative = optarg[0] == '~';
1383 items = negative ? optarg + 1 : optarg;
1384
1385 for (;;) {
1386 _cleanup_free_ char *word = NULL;
1387
1388 r = extract_first_word(&items, &word, NULL, 0);
1389 if (r == 0)
1390 break;
1391 if (r == -ENOMEM)
1392 return log_oom();
1393 if (r < 0)
1394 return log_error_errno(r, "Failed to parse system call filter: %m");
1395
1396 if (negative)
6b000af4 1397 r = strv_extend(&arg_syscall_deny_list, word);
960e4569 1398 else
6b000af4 1399 r = strv_extend(&arg_syscall_allow_list, word);
960e4569
LP		 1400 if (r < 0)
1401 return log_oom();
1402 }
1403
1404 arg_settings_mask |= SETTING_SYSCALL_FILTER;
1405 break;
1406 }
1407
bf428efb
LP		 1408 case ARG_RLIMIT: {
1409 const char *eq;
622ecfa8 1410 _cleanup_free_ char *name = NULL;
bf428efb
LP		 1411 int rl;
1412
5c828e66
LP		 1413 if (streq(optarg, "help")) {
1414 DUMP_STRING_TABLE(rlimit, int, _RLIMIT_MAX);
1415 return 0;
1416 }
1417
bf428efb 1418 eq = strchr(optarg, '=');
baaa35ad
ZJS		 1419 if (!eq)
1420 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1421 "--rlimit= expects an '=' assignment.");
bf428efb
LP		 1422
1423 name = strndup(optarg, eq - optarg);
1424 if (!name)
1425 return log_oom();
1426
1427 rl = rlimit_from_string_harder(name);
baaa35ad
ZJS		 1428 if (rl < 0)
1429 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1430 "Unknown resource limit: %s", name);
bf428efb
LP		 1431
1432 if (!arg_rlimit[rl]) {
1433 arg_rlimit[rl] = new0(struct rlimit, 1);
1434 if (!arg_rlimit[rl])
1435 return log_oom();
1436 }
1437
1438 r = rlimit_parse(rl, eq + 1, arg_rlimit[rl]);
1439 if (r < 0)
1440 return log_error_errno(r, "Failed to parse resource limit: %s", eq + 1);
1441
1442 arg_settings_mask |= SETTING_RLIMIT_FIRST << rl;
1443 break;
1444 }
1445
81f345df
LP		 1446 case ARG_OOM_SCORE_ADJUST:
1447 r = parse_oom_score_adjust(optarg, &arg_oom_score_adjust);
1448 if (r < 0)
1449 return log_error_errno(r, "Failed to parse --oom-score-adjust= parameter: %s", optarg);
1450
1451 arg_oom_score_adjust_set = true;
1452 arg_settings_mask |= SETTING_OOM_SCORE_ADJUST;
1453 break;
1454
d107bb7d 1455 case ARG_CPU_AFFINITY: {
0985c7c4 1456 CPUSet cpuset;
d107bb7d
LP		 1457
1458 r = parse_cpu_set(optarg, &cpuset);
1459 if (r < 0)
0985c7c4 1460 return log_error_errno(r, "Failed to parse CPU affinity mask %s: %m", optarg);
d107bb7d 1461
0985c7c4
ZJS		 1462 cpu_set_reset(&arg_cpu_set);
1463 arg_cpu_set = cpuset;
d107bb7d
LP		 1464 arg_settings_mask |= SETTING_CPU_AFFINITY;
1465 break;
1466 }
1467
09d423e9
LP		 1468 case ARG_RESOLV_CONF:
1469 if (streq(optarg, "help")) {
1470 DUMP_STRING_TABLE(resolv_conf_mode, ResolvConfMode, _RESOLV_CONF_MODE_MAX);
1471 return 0;
1472 }
1473
1474 arg_resolv_conf = resolv_conf_mode_from_string(optarg);
baaa35ad
ZJS		 1475 if (arg_resolv_conf < 0)
1476 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1477 "Failed to parse /etc/resolv.conf mode: %s", optarg);
09d423e9
LP		 1478
1479 arg_settings_mask |= SETTING_RESOLV_CONF;
1480 break;
1481
1688841f
LP		 1482 case ARG_TIMEZONE:
1483 if (streq(optarg, "help")) {
1484 DUMP_STRING_TABLE(timezone_mode, TimezoneMode, _TIMEZONE_MODE_MAX);
1485 return 0;
1486 }
1487
1488 arg_timezone = timezone_mode_from_string(optarg);
baaa35ad
ZJS		 1489 if (arg_timezone < 0)
1490 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1491 "Failed to parse /etc/localtime mode: %s", optarg);
1688841f
LP		 1492
1493 arg_settings_mask |= SETTING_TIMEZONE;
1494 break;
1495
de40a303 1496 case ARG_CONSOLE:
dce66ffe
ZJS		 1497 r = handle_arg_console(optarg);
1498 if (r <= 0)
1499 return r;
de40a303
LP		 1500 break;
1501
1502 case 'P':
1503 case ARG_PIPE:
dce66ffe
ZJS		 1504 r = handle_arg_console("pipe");
1505 if (r <= 0)
1506 return r;
de40a303
LP		 1507 break;
1508
bb068de0
ZJS		 1509 case ARG_NO_PAGER:
1510 arg_pager_flags |= PAGER_DISABLE;
1511 break;
1512
3652872a
LP		 1513 case ARG_SET_CREDENTIAL: {
1514 _cleanup_free_ char *word = NULL, *data = NULL;
1515 const char *p = optarg;
1516 Credential *a;
1517 size_t i;
1518 int l;
1519
1520 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1521 if (r == -ENOMEM)
1522 return log_oom();
1523 if (r < 0)
1524 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1525 if (r == 0 || !p)
1526 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1527
1528 if (!credential_name_valid(word))
1529 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1530
1531 for (i = 0; i < arg_n_credentials; i++)
1532 if (streq(arg_credentials[i].id, word))
1533 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1534
1535 l = cunescape(p, UNESCAPE_ACCEPT_NUL, &data);
1536 if (l < 0)
1537 return log_error_errno(l, "Failed to unescape credential data: %s", p);
1538
1539 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1540 if (!a)
1541 return log_oom();
1542
1543 a[arg_n_credentials++] = (Credential) {
1544 .id = TAKE_PTR(word),
1545 .data = TAKE_PTR(data),
1546 .size = l,
1547 };
1548
1549 arg_credentials = a;
1550
1551 arg_settings_mask |= SETTING_CREDENTIALS;
1552 break;
1553 }
1554
1555 case ARG_LOAD_CREDENTIAL: {
1556 ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
1557 _cleanup_(erase_and_freep) char *data = NULL;
1558 _cleanup_free_ char *word = NULL, *j = NULL;
1559 const char *p = optarg;
1560 Credential *a;
1561 size_t size, i;
1562
1563 r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1564 if (r == -ENOMEM)
1565 return log_oom();
1566 if (r < 0)
1567 return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
1568 if (r == 0 || !p)
1569 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", optarg);
1570
1571 if (!credential_name_valid(word))
1572 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
1573
1574 for (i = 0; i < arg_n_credentials; i++)
1575 if (streq(arg_credentials[i].id, word))
1576 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
1577
1578 if (path_is_absolute(p))
1579 flags |= READ_FULL_FILE_CONNECT_SOCKET;
1580 else {
1581 const char *e;
1582
1583 e = getenv("CREDENTIALS_DIRECTORY");
1584 if (!e)
1585 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential not available (no credentials passed at all): %s", word);
1586
1587 j = path_join(e, p);
1588 if (!j)
1589 return log_oom();
1590 }
1591
986311c2
LP		 1592 r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
1593 flags,
1594 NULL,
1595 &data, &size);
3652872a
LP		 1596 if (r < 0)
1597 return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
1598
1599 a = reallocarray(arg_credentials, arg_n_credentials + 1, sizeof(Credential));
1600 if (!a)
1601 return log_oom();
1602
1603 a[arg_n_credentials++] = (Credential) {
1604 .id = TAKE_PTR(word),
1605 .data = TAKE_PTR(data),
1606 .size = size,
1607 };
1608
1609 arg_credentials = a;
1610
1611 arg_settings_mask |= SETTING_CREDENTIALS;
1612 break;
1613 }
1614
88213476
LP		 1615 case '?':
1616 return -EINVAL;
1617
1618 default:
eb9da376 1619 assert_not_reached("Unhandled option");
88213476 1620 }
88213476 1621
60f1ec13
LP		 1622 if (argc > optind) {
1623 strv_free(arg_parameters);
1624 arg_parameters = strv_copy(argv + optind);
1625 if (!arg_parameters)
1626 return log_oom();
d7bea6b6 1627
60f1ec13
LP		 1628 arg_settings_mask |= SETTING_START_MODE;
1629 }
1630
1631 if (arg_ephemeral && arg_template && !arg_directory)
1632 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1633 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1634 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1635 * --directory=". */
1636 arg_directory = TAKE_PTR(arg_template);
1637
bd4b15f2 1638 arg_caps_retain = (arg_caps_retain | plus | (arg_private_network ? UINT64_C(1) << CAP_NET_ADMIN : 0)) & ~minus;
60f1ec13 1639
de40a303 1640 /* Make sure to parse environment before we reset the settings mask below */
49048684
ZJS		 1641 r = parse_environment();
1642 if (r < 0)
1643 return r;
de40a303 1644
60f1ec13
LP		 1645 /* Load all settings from .nspawn files */
1646 if (mask_no_settings)
1647 arg_settings_mask = 0;
1648
1649 /* Don't load any settings from .nspawn files */
1650 if (mask_all_settings)
1651 arg_settings_mask = _SETTINGS_MASK_ALL;
1652
1653 return 1;
1654}
1655
1656static int verify_arguments(void) {
1657 int r;
a6b5216c 1658
75b0d8b8
ZJS		 1659 if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
1660 /* If we are running the stub init in the container, we don't need to look at what the init
1661 * in the container supports, because we are not using it. Let's immediately pick the right
1662 * setting based on the host system configuration.
1663 *
1664 * We only do this, if the user didn't use an environment variable to override the detection.
1665 */
1666
1667 r = cg_all_unified();
1668 if (r < 0)
1669 return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
1670 if (r > 0)
1671 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
1672 else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
1673 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
1674 else
1675 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
1676 }
1677
4f086aab
SU		 1678 if (arg_userns_mode != USER_NAMESPACE_NO)
1679 arg_mount_settings |= MOUNT_USE_USERNS;
1680
1681 if (arg_private_network)
1682 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1683
48a8d337
LB		 1684 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1685 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
eb91eb18 1686 arg_register = false;
baaa35ad 1687 if (arg_start_mode != START_PID1)
60f1ec13 1688 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--boot cannot be used without namespacing.");
0c582db0 1689 }
eb91eb18 1690
0de7acce 1691 if (arg_userns_mode == USER_NAMESPACE_PICK)
0e7ac751
LP		 1692 arg_userns_chown = true;
1693
60f1ec13
LP		 1694 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
1695 arg_kill_signal = SIGRTMIN+3;
1696
e5a4bb0d
LP		 1697 if (arg_volatile_mode != VOLATILE_NO) /* Make sure all file systems contained in the image are mounted read-only if we are in volatile mode */
1698 arg_read_only = true;
1699
2436ea76
DDM		 1700 if (has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts))
1701 arg_read_only = true;
1702
baaa35ad 1703 if (arg_keep_unit && arg_register && cg_pid_get_owner_uid(0, NULL) >= 0)
8d9c2bca
AJ		 1704 /* Save the user from accidentally registering either user-$SESSION.scope or user@.service.
1705 * The latter is not technically a user session, but we don't need to labour the point. */
60f1ec13 1706 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--keep-unit --register=yes may not be used when invoked from a user session.");
89f7c846 1707
baaa35ad 1708 if (arg_directory && arg_image)
60f1ec13 1709 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--directory= and --image= may not be combined.");
1b9e5b12 1710
baaa35ad 1711 if (arg_template && arg_image)
60f1ec13 1712 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= and --image= may not be combined.");
8cd328d8 1713
baaa35ad 1714 if (arg_template && !(arg_directory || arg_machine))
60f1ec13 1715 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--template= needs --directory= or --machine=.");
ec16945e 1716
baaa35ad 1717 if (arg_ephemeral && arg_template)
60f1ec13 1718 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --template= may not be combined.");
ec16945e 1719
baaa35ad 1720 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO))
60f1ec13 1721 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--ephemeral and --link-journal= may not be combined.");
df9a75e4 1722
baaa35ad 1723 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported())
60f1ec13 1724 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--private-users= is not supported, kernel compiled without user namespace support.");
7336138e 1725
baaa35ad 1726 if (arg_userns_chown && arg_read_only)
de40a303
LP		 1727 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1728 "--read-only and --private-users-chown may not be combined.");
f757855e 1729
e5a4bb0d
LP		 1730 /* We don't support --private-users-chown together with any of the volatile modes since we couldn't
1731 * change the read-only part of the tree (i.e. /usr) anyway, or because it would trigger a massive
5238e957 1732 * copy-up (in case of overlay) making the entire exercise pointless. */
e5a4bb0d
LP		 1733 if (arg_userns_chown && arg_volatile_mode != VOLATILE_NO)
1734 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--volatile= and --private-users-chown may not be combined.");
1735
679ecd36
SZ		 1736 /* If --network-namespace-path is given with any other network-related option (except --private-network),
1737 * we need to error out, to avoid conflicts between different network options. */
60f1ec13
LP		 1738 if (arg_network_namespace_path &&
1739 (arg_network_interfaces || arg_network_macvlan ||
1740 arg_network_ipvlan || arg_network_veth_extra ||
1741 arg_network_bridge || arg_network_zone ||
679ecd36 1742 arg_network_veth))
de40a303 1743 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--network-namespace-path= cannot be combined with other network options.");
86c0dd4a 1744
60f1ec13 1745 if (arg_network_bridge && arg_network_zone)
de40a303
LP		 1746 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1747 "--network-bridge= and --network-zone= may not be combined.");
f757855e 1748
baaa35ad 1749 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network)
60f1ec13 1750 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
4f086aab 1751
baaa35ad 1752 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO))
60f1ec13 1753 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot combine --private-users with read-write mounts.");
f757855e 1754
baaa35ad 1755 if (arg_expose_ports && !arg_private_network)
60f1ec13 1756 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use --port= without private networking.");
6d0b55c2 1757
349cc4a5 1758#if ! HAVE_LIBIPTC
baaa35ad 1759 if (arg_expose_ports)
60f1ec13 1760 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "--port= is not supported, compiled without libiptc support.");
1c1ea217
EV		 1761#endif
1762
60f1ec13
LP		 1763 r = custom_mount_check_all();
1764 if (r < 0)
1765 return r;
c6c8f6e2 1766
f757855e 1767 return 0;
88213476
LP		 1768}
1769
03cfe0d5
LP		 1770static int userns_lchown(const char *p, uid_t uid, gid_t gid) {
1771 assert(p);
1772
0de7acce 1773 if (arg_userns_mode == USER_NAMESPACE_NO)
03cfe0d5
LP		 1774 return 0;
1775
1776 if (uid == UID_INVALID && gid == GID_INVALID)
1777 return 0;
1778
1779 if (uid != UID_INVALID) {
1780 uid += arg_uid_shift;
1781
1782 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1783 return -EOVERFLOW;
1784 }
1785
1786 if (gid != GID_INVALID) {
1787 gid += (gid_t) arg_uid_shift;
1788
1789 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1790 return -EOVERFLOW;
1791 }
1792
1793 if (lchown(p, uid, gid) < 0)
1794 return -errno;
b12afc8c
LP		 1795
1796 return 0;
1797}
1798
03cfe0d5
LP		 1799static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
1800 const char *q;
dae8b82e 1801 int r;
03cfe0d5
LP		 1802
1803 q = prefix_roota(root, path);
dae8b82e
ZJS		 1804 r = mkdir_errno_wrapper(q, mode);
1805 if (r == -EEXIST)
1806 return 0;
1807 if (r < 0)
1808 return r;
03cfe0d5
LP		 1809
1810 return userns_lchown(q, uid, gid);
1811}
1812
1688841f 1813static const char *timezone_from_path(const char *path) {
da9fc98d
LP		 1814 return PATH_STARTSWITH_SET(
1815 path,
1816 "../usr/share/zoneinfo/",
1817 "/usr/share/zoneinfo/");
1688841f
LP		 1818}
1819
83205269
LP		 1820static bool etc_writable(void) {
1821 return !arg_read_only || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_OVERLAY);
1822}
1823
e58a1277 1824static int setup_timezone(const char *dest) {
1688841f
LP		 1825 _cleanup_free_ char *p = NULL, *etc = NULL;
1826 const char *where, *check;
1827 TimezoneMode m;
d4036145 1828 int r;
f8440af5 1829
e58a1277
LP		 1830 assert(dest);
1831
1688841f 1832 if (IN_SET(arg_timezone, TIMEZONE_AUTO, TIMEZONE_SYMLINK)) {
1688841f
LP		 1833 r = readlink_malloc("/etc/localtime", &p);
1834 if (r == -ENOENT && arg_timezone == TIMEZONE_AUTO)
83205269 1835 m = etc_writable() ? TIMEZONE_DELETE : TIMEZONE_OFF;
1688841f 1836 else if (r == -EINVAL && arg_timezone == TIMEZONE_AUTO) /* regular file? */
83205269 1837 m = etc_writable() ? TIMEZONE_COPY : TIMEZONE_BIND;
1688841f
LP		 1838 else if (r < 0) {
1839 log_warning_errno(r, "Failed to read host's /etc/localtime symlink, not updating container timezone: %m");
1840 /* To handle warning, delete /etc/localtime and replace it with a symbolic link to a time zone data
1841 * file.
1842 *
1843 * Example:
1844 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
1845 */
1846 return 0;
1847 } else if (arg_timezone == TIMEZONE_AUTO)
83205269 1848 m = etc_writable() ? TIMEZONE_SYMLINK : TIMEZONE_BIND;
1688841f
LP		 1849 else
1850 m = arg_timezone;
1851 } else
1852 m = arg_timezone;
1853
1854 if (m == TIMEZONE_OFF)
1855 return 0;
1856
a5648b80 1857 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
d4036145 1858 if (r < 0) {
1688841f 1859 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
d4036145
LP		 1860 return 0;
1861 }
1862
1688841f
LP		 1863 where = strjoina(etc, "/localtime");
1864
1865 switch (m) {
1866
1867 case TIMEZONE_DELETE:
1868 if (unlink(where) < 0)
1869 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
1870
d4036145 1871 return 0;
d4036145 1872
1688841f
LP		 1873 case TIMEZONE_SYMLINK: {
1874 _cleanup_free_ char *q = NULL;
1875 const char *z, *what;
4d1c38b8 1876
1688841f
LP		 1877 z = timezone_from_path(p);
1878 if (!z) {
1879 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
d4036145 1880 return 0;
1688841f 1881 }
d4036145 1882
1688841f
LP		 1883 r = readlink_malloc(where, &q);
1884 if (r >= 0 && streq_ptr(timezone_from_path(q), z))
1885 return 0; /* Already pointing to the right place? Then do nothing .. */
1886
1887 check = strjoina(dest, "/usr/share/zoneinfo/", z);
a5648b80 1888 r = chase_symlinks(check, dest, 0, NULL, NULL);
1688841f
LP		 1889 if (r < 0)
1890 log_debug_errno(r, "Timezone %s does not exist (or is not accessible) in container, not creating symlink: %m", z);
1891 else {
1892 if (unlink(where) < 0 && errno != ENOENT) {
1893 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1894 errno, "Failed to remove existing timezone info %s in container, ignoring: %m", where);
1895 return 0;
1896 }
1897
1898 what = strjoina("../usr/share/zoneinfo/", z);
1899 if (symlink(what, where) < 0) {
1900 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
1901 errno, "Failed to correct timezone of container, ignoring: %m");
1902 return 0;
1903 }
1904
1905 break;
1906 }
1907
1908 _fallthrough_;
d4036145 1909 }
68fb0892 1910
1688841f
LP		 1911 case TIMEZONE_BIND: {
1912 _cleanup_free_ char *resolved = NULL;
1913 int found;
1914
a5648b80 1915 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
1688841f
LP		 1916 if (found < 0) {
1917 log_warning_errno(found, "Failed to resolve /etc/localtime path in container, ignoring: %m");
1918 return 0;
1919 }
1920
1921 if (found == 0) /* missing? */
1922 (void) touch(resolved);
1923
511a8cfe 1924 r = mount_nofollow_verbose(LOG_WARNING, "/etc/localtime", resolved, NULL, MS_BIND, NULL);
1688841f 1925 if (r >= 0)
511a8cfe 1926 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
1688841f
LP		 1927
1928 _fallthrough_;
79d80fc1 1929 }
4d9f07b4 1930
1688841f
LP		 1931 case TIMEZONE_COPY:
1932 /* If mounting failed, try to copy */
8a016c74 1933 r = copy_file_atomic("/etc/localtime", where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
1688841f
LP		 1934 if (r < 0) {
1935 log_full_errno(IN_SET(r, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
1936 "Failed to copy /etc/localtime to %s, ignoring: %m", where);
1937 return 0;
1938 }
1939
1940 break;
1941
1942 default:
1943 assert_not_reached("unexpected mode");
d4036145 1944 }
e58a1277 1945
1688841f 1946 /* Fix permissions of the symlink or file copy we just created */
03cfe0d5
LP		 1947 r = userns_lchown(where, 0, 0);
1948 if (r < 0)
1688841f 1949 log_warning_errno(r, "Failed to chown /etc/localtime, ignoring: %m");
03cfe0d5 1950
e58a1277 1951 return 0;
88213476
LP		 1952}
1953
09d423e9
LP		 1954static int have_resolv_conf(const char *path) {
1955 assert(path);
1956
1957 if (access(path, F_OK) < 0) {
1958 if (errno == ENOENT)
1959 return 0;
1960
1961 return log_debug_errno(errno, "Failed to determine whether '%s' is available: %m", path);
1962 }
1963
1964 return 1;
1965}
1966
7357272e 1967static int resolved_listening(void) {
b8ea7a6e 1968 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
b053cd5f 1969 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
7357272e 1970 _cleanup_free_ char *dns_stub_listener_mode = NULL;
b053cd5f
LP		 1971 int r;
1972
7357272e 1973 /* Check if resolved is listening */
b053cd5f
LP		 1974
1975 r = sd_bus_open_system(&bus);
1976 if (r < 0)
b8ea7a6e 1977 return log_debug_errno(r, "Failed to open system bus: %m");
b053cd5f 1978
7357272e 1979 r = bus_name_has_owner(bus, "org.freedesktop.resolve1", NULL);
b8ea7a6e
LP		 1980 if (r < 0)
1981 return log_debug_errno(r, "Failed to check whether the 'org.freedesktop.resolve1' bus name is taken: %m");
1982 if (r == 0)
1983 return 0;
7357272e
DM		 1984
1985 r = sd_bus_get_property_string(bus,
1986 "org.freedesktop.resolve1",
1987 "/org/freedesktop/resolve1",
1988 "org.freedesktop.resolve1.Manager",
1989 "DNSStubListener",
b8ea7a6e 1990 &error,
7357272e
DM		 1991 &dns_stub_listener_mode);
1992 if (r < 0)
b8ea7a6e 1993 return log_debug_errno(r, "Failed to query DNSStubListener property: %s", bus_error_message(&error, r));
7357272e
DM		 1994
1995 return STR_IN_SET(dns_stub_listener_mode, "udp", "yes");
b053cd5f
LP		 1996}
1997
2547bb41 1998static int setup_resolv_conf(const char *dest) {
09d423e9
LP		 1999 _cleanup_free_ char *etc = NULL;
2000 const char *where, *what;
2001 ResolvConfMode m;
2002 int r;
2547bb41
LP		 2003
2004 assert(dest);
2005
09d423e9
LP		 2006 if (arg_resolv_conf == RESOLV_CONF_AUTO) {
2007 if (arg_private_network)
2008 m = RESOLV_CONF_OFF;
86775e35
LP		 2009 else if (have_resolv_conf(PRIVATE_STUB_RESOLV_CONF) > 0 && resolved_listening() > 0)
2010 m = etc_writable() ? RESOLV_CONF_COPY_STUB : RESOLV_CONF_BIND_STUB;
09d423e9 2011 else if (have_resolv_conf("/etc/resolv.conf") > 0)
83205269 2012 m = etc_writable() ? RESOLV_CONF_COPY_HOST : RESOLV_CONF_BIND_HOST;
09d423e9 2013 else
83205269 2014 m = etc_writable() ? RESOLV_CONF_DELETE : RESOLV_CONF_OFF;
86775e35 2015
09d423e9
LP		 2016 } else
2017 m = arg_resolv_conf;
2018
2019 if (m == RESOLV_CONF_OFF)
2547bb41
LP		 2020 return 0;
2021
a5648b80 2022 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc, NULL);
87447ae4
LP		 2023 if (r < 0) {
2024 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
2025 return 0;
2026 }
2027
2028 where = strjoina(etc, "/resolv.conf");
09d423e9
LP		 2029
2030 if (m == RESOLV_CONF_DELETE) {
2031 if (unlink(where) < 0)
2032 log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, "Failed to remove '%s', ignoring: %m", where);
2033
87447ae4
LP		 2034 return 0;
2035 }
79d80fc1 2036
86775e35
LP		 2037 if (IN_SET(m, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_COPY_STATIC))
2038 what = PRIVATE_STATIC_RESOLV_CONF;
2039 else if (IN_SET(m, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_COPY_UPLINK))
2040 what = PRIVATE_UPLINK_RESOLV_CONF;
2041 else if (IN_SET(m, RESOLV_CONF_BIND_STUB, RESOLV_CONF_REPLACE_STUB, RESOLV_CONF_COPY_STUB))
2042 what = PRIVATE_STUB_RESOLV_CONF;
09d423e9
LP		 2043 else
2044 what = "/etc/resolv.conf";
87447ae4 2045
86775e35 2046 if (IN_SET(m, RESOLV_CONF_BIND_HOST, RESOLV_CONF_BIND_STATIC, RESOLV_CONF_BIND_UPLINK, RESOLV_CONF_BIND_STUB)) {
09d423e9
LP		 2047 _cleanup_free_ char *resolved = NULL;
2048 int found;
2049
a5648b80 2050 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved, NULL);
09d423e9
LP		 2051 if (found < 0) {
2052 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
2053 return 0;
2054 }
3539724c 2055
87447ae4
LP		 2056 if (found == 0) /* missing? */
2057 (void) touch(resolved);
5367354d 2058
511a8cfe 2059 r = mount_nofollow_verbose(LOG_WARNING, what, resolved, NULL, MS_BIND, NULL);
60e76d48 2060 if (r >= 0)
511a8cfe 2061 return mount_nofollow_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
86775e35
LP		 2062
2063 /* If that didn't work, let's copy the file */
3539724c
LP		 2064 }
2065
86775e35
LP		 2066 if (IN_SET(m, RESOLV_CONF_REPLACE_HOST, RESOLV_CONF_REPLACE_STATIC, RESOLV_CONF_REPLACE_UPLINK, RESOLV_CONF_REPLACE_STUB))
2067 r = copy_file_atomic(what, where, 0644, 0, 0, COPY_REFLINK|COPY_REPLACE);
2068 else
2069 r = copy_file(what, where, O_TRUNC|O_NOFOLLOW, 0644, 0, 0, COPY_REFLINK);
79d80fc1 2070 if (r < 0) {
3539724c
LP		 2071 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
2072 * resolved or something similar runs inside and the symlink points there.
68a313c5 2073 *
3539724c 2074 * If the disk image is read-only, there's also no point in complaining.
68a313c5 2075 */
86775e35
LP		 2076 log_full_errno(!IN_SET(RESOLV_CONF_COPY_HOST, RESOLV_CONF_COPY_STATIC, RESOLV_CONF_COPY_UPLINK, RESOLV_CONF_COPY_STUB) &&
2077 IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
3539724c 2078 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
79d80fc1
TG		 2079 return 0;
2080 }
2547bb41 2081
03cfe0d5
LP		 2082 r = userns_lchown(where, 0, 0);
2083 if (r < 0)
3539724c 2084 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
03cfe0d5 2085
2547bb41
LP		 2086 return 0;
2087}
2088
1e4f1671 2089static int setup_boot_id(void) {
cdde6ba6
LP		 2090 _cleanup_(unlink_and_freep) char *from = NULL;
2091 _cleanup_free_ char *path = NULL;
3bbaff3e 2092 sd_id128_t rnd = SD_ID128_NULL;
cdde6ba6 2093 const char *to;
04bc4a3f
LP		 2094 int r;
2095
1eacc470 2096 /* Generate a new randomized boot ID, so that each boot-up of the container gets a new one */
04bc4a3f 2097
1eacc470 2098 r = tempfn_random_child("/run", "proc-sys-kernel-random-boot-id", &path);
cdde6ba6
LP		 2099 if (r < 0)
2100 return log_error_errno(r, "Failed to generate random boot ID path: %m");
04bc4a3f
LP		 2101
2102 r = sd_id128_randomize(&rnd);
f647962d
MS		 2103 if (r < 0)
2104 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 2105
cdde6ba6 2106 r = id128_write(path, ID128_UUID, rnd, false);
f647962d
MS		 2107 if (r < 0)
2108 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 2109
cdde6ba6
LP		 2110 from = TAKE_PTR(path);
2111 to = "/proc/sys/kernel/random/boot_id";
2112
511a8cfe 2113 r = mount_nofollow_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
cdde6ba6
LP		 2114 if (r < 0)
2115 return r;
04bc4a3f 2116
511a8cfe 2117 return mount_nofollow_verbose(LOG_ERR, NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
04bc4a3f
LP		 2118}
2119
e58a1277 2120static int copy_devnodes(const char *dest) {
88213476
LP		 2121 static const char devnodes[] =
2122 "null\0"
2123 "zero\0"
2124 "full\0"
2125 "random\0"
2126 "urandom\0"
85614d66
TG		 2127 "tty\0"
2128 "net/tun\0";
88213476 2129
de40a303 2130 _cleanup_umask_ mode_t u;
88213476 2131 const char *d;
e58a1277 2132 int r = 0;
a258bf26
LP		 2133
2134 assert(dest);
124640f1
LP		 2135
2136 u = umask(0000);
88213476 2137
03cfe0d5
LP		 2138 /* Create /dev/net, so that we can create /dev/net/tun in it */
2139 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
2140 return log_error_errno(r, "Failed to create /dev/net directory: %m");
2141
88213476 2142 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 2143 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 2144 struct stat st;
88213476 2145
c6134d3e 2146 from = path_join("/dev/", d);
8967f291
LP		 2147 if (!from)
2148 return log_oom();
2149
c6134d3e 2150 to = path_join(dest, from);
8967f291
LP		 2151 if (!to)
2152 return log_oom();
88213476
LP		 2153
2154 if (stat(from, &st) < 0) {
2155
4a62c710
MS		 2156 if (errno != ENOENT)
2157 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 2158
baaa35ad
ZJS		 2159 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode))
2160 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2161 "%s is not a char or block device, cannot copy.", from);
2162 else {
8dfce114
LP		 2163 _cleanup_free_ char *sl = NULL, *prefixed = NULL, *dn = NULL, *t = NULL;
2164
81f5049b 2165 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
8dbf71ec 2166 /* Explicitly warn the user when /dev is already populated. */
41eb4362 2167 if (errno == EEXIST)
8dbf71ec 2168 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
81f5049b
AC		 2169 if (errno != EPERM)
2170 return log_error_errno(errno, "mknod(%s) failed: %m", to);
2171
8dfce114 2172 /* Some systems abusively restrict mknod but allow bind mounts. */
81f5049b
AC		 2173 r = touch(to);
2174 if (r < 0)
2175 return log_error_errno(r, "touch (%s) failed: %m", to);
511a8cfe 2176 r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2177 if (r < 0)
2178 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
81f5049b 2179 }
6278cf60 2180
03cfe0d5
LP		 2181 r = userns_lchown(to, 0, 0);
2182 if (r < 0)
2183 return log_error_errno(r, "chown() of device node %s failed: %m", to);
8dfce114 2184
657ee2d8 2185 dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
8dfce114
LP		 2186 if (!dn)
2187 return log_oom();
2188
2189 r = userns_mkdir(dest, dn, 0755, 0, 0);
2190 if (r < 0)
2191 return log_error_errno(r, "Failed to create '%s': %m", dn);
2192
2193 if (asprintf(&sl, "%s/%u:%u", dn, major(st.st_rdev), minor(st.st_rdev)) < 0)
2194 return log_oom();
2195
c6134d3e 2196 prefixed = path_join(dest, sl);
8dfce114
LP		 2197 if (!prefixed)
2198 return log_oom();
2199
2d9b74ba 2200 t = path_join("..", d);
8dfce114
LP		 2201 if (!t)
2202 return log_oom();
2203
2204 if (symlink(t, prefixed) < 0)
2205 log_debug_errno(errno, "Failed to symlink '%s' to '%s': %m", t, prefixed);
88213476 2206 }
88213476
LP		 2207 }
2208
e58a1277
LP		 2209 return r;
2210}
88213476 2211
de40a303
LP		 2212static int make_extra_nodes(const char *dest) {
2213 _cleanup_umask_ mode_t u;
2214 size_t i;
2215 int r;
2216
2217 u = umask(0000);
2218
2219 for (i = 0; i < arg_n_extra_nodes; i++) {
2220 _cleanup_free_ char *path = NULL;
2221 DeviceNode *n = arg_extra_nodes + i;
2222
c6134d3e 2223 path = path_join(dest, n->path);
de40a303
LP		 2224 if (!path)
2225 return log_oom();
2226
2227 if (mknod(path, n->mode, S_ISCHR(n->mode) || S_ISBLK(n->mode) ? makedev(n->major, n->minor) : 0) < 0)
2228 return log_error_errno(errno, "Failed to create device node '%s': %m", path);
2229
2230 r = chmod_and_chown(path, n->mode, n->uid, n->gid);
2231 if (r < 0)
2232 return log_error_errno(r, "Failed to adjust device node ownership of '%s': %m", path);
2233 }
2234
2235 return 0;
2236}
2237
03cfe0d5
LP		 2238static int setup_pts(const char *dest) {
2239 _cleanup_free_ char *options = NULL;
2240 const char *p;
709f6e46 2241 int r;
03cfe0d5 2242
349cc4a5 2243#if HAVE_SELINUX
03cfe0d5
LP		 2244 if (arg_selinux_apifs_context)
2245 (void) asprintf(&options,
3dce8915 2246 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 2247 arg_uid_shift + TTY_GID,
2248 arg_selinux_apifs_context);
2249 else
2250#endif
2251 (void) asprintf(&options,
3dce8915 2252 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 2253 arg_uid_shift + TTY_GID);
f2d88580 2254
03cfe0d5 2255 if (!options)
f2d88580
LP		 2256 return log_oom();
2257
03cfe0d5 2258 /* Mount /dev/pts itself */
cc9fce65 2259 p = prefix_roota(dest, "/dev/pts");
dae8b82e
ZJS		 2260 r = mkdir_errno_wrapper(p, 0755);
2261 if (r < 0)
2262 return log_error_errno(r, "Failed to create /dev/pts: %m");
2263
511a8cfe 2264 r = mount_nofollow_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
60e76d48
ZJS		 2265 if (r < 0)
2266 return r;
709f6e46
MS		 2267 r = userns_lchown(p, 0, 0);
2268 if (r < 0)
2269 return log_error_errno(r, "Failed to chown /dev/pts: %m");
03cfe0d5
LP		 2270
2271 /* Create /dev/ptmx symlink */
2272 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 2273 if (symlink("pts/ptmx", p) < 0)
2274 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
709f6e46
MS		 2275 r = userns_lchown(p, 0, 0);
2276 if (r < 0)
2277 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
f2d88580 2278
03cfe0d5
LP		 2279 /* And fix /dev/pts/ptmx ownership */
2280 p = prefix_roota(dest, "/dev/pts/ptmx");
709f6e46
MS		 2281 r = userns_lchown(p, 0, 0);
2282 if (r < 0)
2283 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 2284
f2d88580
LP		 2285 return 0;
2286}
2287
3acc84eb 2288static int setup_stdio_as_dev_console(void) {
2fef50cd 2289 _cleanup_close_ int terminal = -1;
e58a1277 2290 int r;
e58a1277 2291
335d2ead
LP		 2292 /* We open the TTY in O_NOCTTY mode, so that we do not become controller yet. We'll do that later
2293 * explicitly, if we are configured to. */
2294 terminal = open_terminal("/dev/console", O_RDWR|O_NOCTTY);
3acc84eb
FB		 2295 if (terminal < 0)
2296 return log_error_errno(terminal, "Failed to open console: %m");
e58a1277 2297
3acc84eb
FB		 2298 /* Make sure we can continue logging to the original stderr, even if
2299 * stderr points elsewhere now */
2300 r = log_dup_console();
2301 if (r < 0)
2302 return log_error_errno(r, "Failed to duplicate stderr: %m");
de40a303 2303
3acc84eb
FB		 2304 /* invalidates 'terminal' on success and failure */
2305 r = rearrange_stdio(terminal, terminal, terminal);
2fef50cd 2306 TAKE_FD(terminal);
f647962d 2307 if (r < 0)
3acc84eb
FB		 2308 return log_error_errno(r, "Failed to move console to stdin/stdout/stderr: %m");
2309
2310 return 0;
2311}
88213476 2312
3acc84eb
FB		 2313static int setup_dev_console(const char *console) {
2314 _cleanup_free_ char *p = NULL;
2315 int r;
a258bf26 2316
3acc84eb
FB		 2317 /* Create /dev/console symlink */
2318 r = path_make_relative("/dev", console, &p);
81f5049b 2319 if (r < 0)
3acc84eb
FB		 2320 return log_error_errno(r, "Failed to create relative path: %m");
2321
2322 if (symlink(p, "/dev/console") < 0)
2323 return log_error_errno(errno, "Failed to create /dev/console symlink: %m");
a258bf26 2324
3acc84eb 2325 return 0;
e58a1277
LP		 2326}
2327
8e5430c4
LP		 2328static int setup_keyring(void) {
2329 key_serial_t keyring;
2330
6b000af4
LP		 2331 /* Allocate a new session keyring for the container. This makes sure the keyring of the session
2332 * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
2333 * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
2334 * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
2335 * into the container. */
8e5430c4
LP		 2336
2337 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2338 if (keyring == -1) {
2339 if (errno == ENOSYS)
2340 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
065b4774 2341 else if (ERRNO_IS_PRIVILEGE(errno))
8e5430c4
LP		 2342 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2343 else
2344 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2345 }
2346
2347 return 0;
2348}
2349
3652872a
LP		 2350static int setup_credentials(const char *root) {
2351 const char *q;
2352 int r;
2353
2354 if (arg_n_credentials <= 0)
2355 return 0;
2356
2357 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
2358 if (r < 0)
2359 return log_error_errno(r, "Failed to create /run/host: %m");
2360
2361 r = userns_mkdir(root, "/run/host/credentials", 0700, 0, 0);
2362 if (r < 0)
2363 return log_error_errno(r, "Failed to create /run/host/credentials: %m");
2364
2365 q = prefix_roota(root, "/run/host/credentials");
511a8cfe 2366 r = mount_nofollow_verbose(LOG_ERR, NULL, q, "ramfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0700");
3652872a
LP		 2367 if (r < 0)
2368 return r;
2369
2370 for (size_t i = 0; i < arg_n_credentials; i++) {
2371 _cleanup_free_ char *j = NULL;
2372 _cleanup_close_ int fd = -1;
2373
2374 j = path_join(q, arg_credentials[i].id);
2375 if (!j)
2376 return log_oom();
2377
2378 fd = open(j, O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC|O_NOFOLLOW, 0600);
2379 if (fd < 0)
2380 return log_error_errno(errno, "Failed to create credential file %s: %m", j);
2381
2382 r = loop_write(fd, arg_credentials[i].data, arg_credentials[i].size, /* do_poll= */ false);
2383 if (r < 0)
2384 return log_error_errno(r, "Failed to write credential to file %s: %m", j);
2385
2386 if (fchmod(fd, 0400) < 0)
2387 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", j);
2388
2389 if (arg_userns_mode != USER_NAMESPACE_NO) {
2390 if (fchown(fd, arg_uid_shift, arg_uid_shift) < 0)
2391 return log_error_errno(errno, "Failed to adjust ownership of %s: %m", j);
2392 }
2393 }
2394
2395 if (chmod(q, 0500) < 0)
2396 return log_error_errno(errno, "Failed to adjust access mode of %s: %m", q);
2397
2398 r = userns_lchown(q, 0, 0);
2399 if (r < 0)
2400 return r;
2401
2402 /* Make both mount and superblock read-only now */
511a8cfe 2403 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
3652872a
LP		 2404 if (r < 0)
2405 return r;
2406
511a8cfe 2407 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=0500");
3652872a
LP		 2408}
2409
1e4f1671 2410static int setup_kmsg(int kmsg_socket) {
9ec5a93c
LP		 2411 _cleanup_(unlink_and_freep) char *from = NULL;
2412 _cleanup_free_ char *fifo = NULL;
2413 _cleanup_close_ int fd = -1;
7fd1b19b 2414 _cleanup_umask_ mode_t u;
9ec5a93c 2415 int r;
e58a1277 2416
e58a1277 2417 assert(kmsg_socket >= 0);
a258bf26 2418
e58a1277 2419 u = umask(0000);
a258bf26 2420
1eacc470 2421 /* We create the kmsg FIFO as as temporary file in /run, but immediately delete it after bind mounting it to
9ec5a93c
LP		 2422 * /proc/kmsg. While FIFOs on the reading side behave very similar to /proc/kmsg, their writing side behaves
2423 * differently from /dev/kmsg in that writing blocks when nothing is reading. In order to avoid any problems
2424 * with containers deadlocking due to this we simply make /dev/kmsg unavailable to the container. */
2425
1eacc470 2426 r = tempfn_random_child("/run", "proc-kmsg", &fifo);
9ec5a93c
LP		 2427 if (r < 0)
2428 return log_error_errno(r, "Failed to generate kmsg path: %m");
e58a1277 2429
9ec5a93c 2430 if (mkfifo(fifo, 0600) < 0)
03cfe0d5 2431 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
9ec5a93c
LP		 2432
2433 from = TAKE_PTR(fifo);
9ec5a93c 2434
511a8cfe 2435 r = mount_nofollow_verbose(LOG_ERR, from, "/proc/kmsg", NULL, MS_BIND, NULL);
60e76d48
ZJS		 2436 if (r < 0)
2437 return r;
e58a1277 2438
669fc4e5 2439 fd = open(from, O_RDWR|O_NONBLOCK|O_CLOEXEC);
4a62c710
MS		 2440 if (fd < 0)
2441 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 2442
9ec5a93c 2443 /* Store away the fd in the socket, so that it stays open as long as we run the child */
3ee897d6 2444 r = send_one_fd(kmsg_socket, fd, 0);
d9603714
DH		 2445 if (r < 0)
2446 return log_error_errno(r, "Failed to send FIFO fd: %m");
a258bf26 2447
25ea79fe 2448 return 0;
88213476
LP		 2449}
2450
1c4baffc 2451static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
6d0b55c2
LP		 2452 union in_addr_union *exposed = userdata;
2453
2454 assert(rtnl);
2455 assert(m);
2456 assert(exposed);
2457
7a8f6325 2458 expose_port_execute(rtnl, arg_expose_ports, exposed);
6d0b55c2
LP		 2459 return 0;
2460}
2461
3a74cea5 2462static int setup_hostname(void) {
c818eef1 2463 int r;
3a74cea5 2464
0c582db0 2465 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
eb91eb18
LP		 2466 return 0;
2467
c818eef1
LP		 2468 r = sethostname_idempotent(arg_hostname ?: arg_machine);
2469 if (r < 0)
2470 return log_error_errno(r, "Failed to set hostname: %m");
3a74cea5 2471
7027ff61 2472 return 0;
3a74cea5
LP		 2473}
2474
57fb9fb5 2475static int setup_journal(const char *directory) {
0f5e1382 2476 _cleanup_free_ char *d = NULL;
5905d7cf 2477 char id[SD_ID128_STRING_MAX];
b2238e38
LP		 2478 const char *dirname, *p, *q;
2479 sd_id128_t this_id;
8054d749 2480 bool try;
57fb9fb5
LP		 2481 int r;
2482
df9a75e4
LP		 2483 /* Don't link journals in ephemeral mode */
2484 if (arg_ephemeral)
2485 return 0;
2486
8054d749
LP		 2487 if (arg_link_journal == LINK_NO)
2488 return 0;
2489
2490 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
2491
4d680aee 2492 r = sd_id128_get_machine(&this_id);
f647962d
MS		 2493 if (r < 0)
2494 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee 2495
e01ff70a 2496 if (sd_id128_equal(arg_uuid, this_id)) {
8054d749 2497 log_full(try ? LOG_WARNING : LOG_ERR,
e192a281 2498 "Host and machine ids are equal (%s): refusing to link journals", sd_id128_to_string(arg_uuid, id));
8054d749 2499 if (try)
4d680aee 2500 return 0;
df9a75e4 2501 return -EEXIST;
4d680aee
ZJS		 2502 }
2503
369ca6da
ZJS		 2504 FOREACH_STRING(dirname, "/var", "/var/log", "/var/log/journal") {
2505 r = userns_mkdir(directory, dirname, 0755, 0, 0);
2506 if (r < 0) {
2507 bool ignore = r == -EROFS && try;
2508 log_full_errno(ignore ? LOG_DEBUG : LOG_ERR, r,
2509 "Failed to create %s%s: %m", dirname, ignore ? ", ignoring" : "");
2510 return ignore ? 0 : r;
2511 }
2512 }
03cfe0d5 2513
e01ff70a
MS		 2514 (void) sd_id128_to_string(arg_uuid, id);
2515
03cfe0d5
LP		 2516 p = strjoina("/var/log/journal/", id);
2517 q = prefix_roota(directory, p);
27407a01 2518
e1873695 2519 if (path_is_mount_point(p, NULL, 0) > 0) {
8054d749
LP		 2520 if (try)
2521 return 0;
27407a01 2522
baaa35ad
ZJS		 2523 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2524 "%s: already a mount point, refusing to use for journal", p);
57fb9fb5
LP		 2525 }
2526
e1873695 2527 if (path_is_mount_point(q, NULL, 0) > 0) {
8054d749
LP		 2528 if (try)
2529 return 0;
57fb9fb5 2530
baaa35ad
ZJS		 2531 return log_error_errno(SYNTHETIC_ERRNO(EEXIST),
2532 "%s: already a mount point, refusing to use for journal", q);
57fb9fb5
LP		 2533 }
2534
2535 r = readlink_and_make_absolute(p, &d);
2536 if (r >= 0) {
3742095b 2537 if (IN_SET(arg_link_journal, LINK_GUEST, LINK_AUTO) &&
57fb9fb5
LP		 2538 path_equal(d, q)) {
2539
03cfe0d5 2540 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2541 if (r < 0)
709f6e46 2542 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2543 return 0;
57fb9fb5
LP		 2544 }
2545
4a62c710
MS		 2546 if (unlink(p) < 0)
2547 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 2548 } else if (r == -EINVAL) {
2549
2550 if (arg_link_journal == LINK_GUEST &&
2551 rmdir(p) < 0) {
2552
27407a01
ZJS		 2553 if (errno == ENOTDIR) {
2554 log_error("%s already exists and is neither a symlink nor a directory", p);
2555 return r;
4314d33f
MS		 2556 } else
2557 return log_error_errno(errno, "Failed to remove %s: %m", p);
57fb9fb5 2558 }
4314d33f
MS		 2559 } else if (r != -ENOENT)
2560 return log_error_errno(r, "readlink(%s) failed: %m", p);
57fb9fb5
LP		 2561
2562 if (arg_link_journal == LINK_GUEST) {
2563
2564 if (symlink(q, p) < 0) {
8054d749 2565 if (try) {
56f64d95 2566 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90 2567 return 0;
4314d33f
MS		 2568 } else
2569 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
57fb9fb5
LP		 2570 }
2571
03cfe0d5 2572 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 2573 if (r < 0)
709f6e46 2574 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 2575 return 0;
57fb9fb5
LP		 2576 }
2577
2578 if (arg_link_journal == LINK_HOST) {
ccddd104 2579 /* don't create parents here — if the host doesn't have
574edc90 2580 * permanent journal set up, don't force it here */
ba8e6c4d 2581
dae8b82e
ZJS		 2582 r = mkdir_errno_wrapper(p, 0755);
2583 if (r < 0 && r != -EEXIST) {
8054d749 2584 if (try) {
dae8b82e 2585 log_debug_errno(r, "Failed to create %s, skipping journal setup: %m", p);
574edc90 2586 return 0;
4314d33f 2587 } else
dae8b82e 2588 return log_error_errno(r, "Failed to create %s: %m", p);
57fb9fb5
LP		 2589 }
2590
27407a01
ZJS		 2591 } else if (access(p, F_OK) < 0)
2592 return 0;
57fb9fb5 2593
cdb2b9d0
LP		 2594 if (dir_is_empty(q) == 0)
2595 log_warning("%s is not empty, proceeding anyway.", q);
2596
03cfe0d5 2597 r = userns_mkdir(directory, p, 0755, 0, 0);
709f6e46
MS		 2598 if (r < 0)
2599 return log_error_errno(r, "Failed to create %s: %m", q);
57fb9fb5 2600
511a8cfe 2601 r = mount_nofollow_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
60e76d48 2602 if (r < 0)
4a62c710 2603 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 2604
27407a01 2605 return 0;
57fb9fb5
LP		 2606}
2607
de40a303
LP		 2608static int drop_capabilities(uid_t uid) {
2609 CapabilityQuintet q;
2610
2611 /* Let's initialize all five capability sets to something valid. If the quintet was configured via
2612 * OCI use that, but fill in missing bits. If it wasn't then derive the quintet in full from
2613 * arg_caps_retain. */
2614
2615 if (capability_quintet_is_set(&arg_full_capabilities)) {
2616 q = arg_full_capabilities;
2617
2618 if (q.bounding == (uint64_t) -1)
2619 q.bounding = uid == 0 ? arg_caps_retain : 0;
2620
2621 if (q.effective == (uint64_t) -1)
2622 q.effective = uid == 0 ? q.bounding : 0;
2623
2624 if (q.inheritable == (uint64_t) -1)
2625 q.inheritable = uid == 0 ? q.bounding : 0;
2626
2627 if (q.permitted == (uint64_t) -1)
2628 q.permitted = uid == 0 ? q.bounding : 0;
2629
2630 if (q.ambient == (uint64_t) -1 && ambient_capabilities_supported())
2631 q.ambient = 0;
f66ad460
AZ		 2632
2633 if (capability_quintet_mangle(&q))
2634 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Cannot set capabilities that are not in the current bounding set.");
2635
2636 } else {
de40a303
LP		 2637 q = (CapabilityQuintet) {
2638 .bounding = arg_caps_retain,
2639 .effective = uid == 0 ? arg_caps_retain : 0,
2640 .inheritable = uid == 0 ? arg_caps_retain : 0,
2641 .permitted = uid == 0 ? arg_caps_retain : 0,
2642 .ambient = ambient_capabilities_supported() ? 0 : (uint64_t) -1,
2643 };
2644
f66ad460
AZ		 2645 /* If we're not using OCI, proceed with mangled capabilities (so we don't error out)
2646 * in order to maintain the same behavior as systemd < 242. */
2647 if (capability_quintet_mangle(&q))
0ccdaa79
JT		 2648 log_full(arg_quiet ? LOG_DEBUG : LOG_WARNING,
2649 "Some capabilities will not be set because they are not in the current bounding set.");
f66ad460
AZ		 2650
2651 }
2652
de40a303 2653 return capability_quintet_enforce(&q);
88213476
LP		 2654}
2655
db999e0f
LP		 2656static int reset_audit_loginuid(void) {
2657 _cleanup_free_ char *p = NULL;
2658 int r;
2659
0c582db0 2660 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
db999e0f
LP		 2661 return 0;
2662
2663 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 2664 if (r == -ENOENT)
db999e0f 2665 return 0;
f647962d
MS		 2666 if (r < 0)
2667 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 2668
2669 /* Already reset? */
2670 if (streq(p, "4294967295"))
2671 return 0;
2672
57512c89 2673 r = write_string_file("/proc/self/loginuid", "4294967295", WRITE_STRING_FILE_DISABLE_BUFFER);
db999e0f 2674 if (r < 0) {
10a87006
LP		 2675 log_error_errno(r,
2676 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2677 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2678 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2679 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2680 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 2681
db999e0f 2682 sleep(5);
77b6e194 2683 }
db999e0f
LP		 2684
2685 return 0;
77b6e194
LP		 2686}
2687
785890ac
LP		 2688static int setup_propagate(const char *root) {
2689 const char *p, *q;
709f6e46 2690 int r;
785890ac
LP		 2691
2692 (void) mkdir_p("/run/systemd/nspawn/", 0755);
2693 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 2694 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 2695 (void) mkdir_p(p, 0600);
2696
5a27b395 2697 r = userns_mkdir(root, "/run/host", 0755, 0, 0);
709f6e46 2698 if (r < 0)
5a27b395 2699 return log_error_errno(r, "Failed to create /run/host: %m");
03cfe0d5 2700
5a27b395 2701 r = userns_mkdir(root, "/run/host/incoming", 0600, 0, 0);
709f6e46 2702 if (r < 0)
5a27b395 2703 return log_error_errno(r, "Failed to create /run/host/incoming: %m");
03cfe0d5 2704
5a27b395 2705 q = prefix_roota(root, "/run/host/incoming");
511a8cfe 2706 r = mount_nofollow_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
60e76d48
ZJS		 2707 if (r < 0)
2708 return r;
785890ac 2709
511a8cfe 2710 r = mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
60e76d48
ZJS		 2711 if (r < 0)
2712 return r;
785890ac 2713
5a27b395 2714 /* machined will MS_MOVE into that directory, and that's only supported for non-shared mounts. */
511a8cfe 2715 return mount_nofollow_verbose(LOG_ERR, NULL, q, NULL, MS_SLAVE, NULL);
785890ac
LP		 2716}
2717
317feb4d 2718static int setup_machine_id(const char *directory) {
691675ba
LP		 2719 const char *etc_machine_id;
2720 sd_id128_t id;
3bbaff3e 2721 int r;
e01ff70a 2722
317feb4d
LP		 2723 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
2724 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
2725 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
2726 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
2727 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
2728 * container behaves nicely). */
2729
e01ff70a
MS		 2730 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2731
c5fbeedb 2732 r = id128_read(etc_machine_id, ID128_PLAIN_OR_UNINIT, &id);
317feb4d
LP		 2733 if (r < 0) {
2734 if (!IN_SET(r, -ENOENT, -ENOMEDIUM)) /* If the file is missing or empty, we don't mind */
2735 return log_error_errno(r, "Failed to read machine ID from container image: %m");
691675ba 2736
317feb4d
LP		 2737 if (sd_id128_is_null(arg_uuid)) {
2738 r = sd_id128_randomize(&arg_uuid);
2739 if (r < 0)
2740 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
2741 }
2742 } else {
baaa35ad
ZJS		 2743 if (sd_id128_is_null(id))
2744 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
2745 "Machine ID in container image is zero, refusing.");
e01ff70a 2746
317feb4d
LP		 2747 arg_uuid = id;
2748 }
691675ba 2749
e01ff70a
MS		 2750 return 0;
2751}
2752
7336138e
LP		 2753static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
2754 int r;
2755
2756 assert(directory);
2757
0de7acce 2758 if (arg_userns_mode == USER_NAMESPACE_NO || !arg_userns_chown)
7336138e
LP		 2759 return 0;
2760
2761 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
2762 if (r == -EOPNOTSUPP)
2763 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
2764 if (r == -EBADE)
2765 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
2766 if (r < 0)
2767 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
2768 if (r == 0)
2769 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
2770 else
2771 log_debug("Patched directory tree to match UID/GID range.");
2772
2773 return r;
2774}
2775
113cea80 2776/*
6d416b9c
LS		 2777 * Return values:
2778 * < 0 : wait_for_terminate() failed to get the state of the
2779 * container, the container was terminated by a signal, or
2780 * failed for an unknown reason. No change is made to the
2781 * container argument.
2782 * > 0 : The program executed in the container terminated with an
2783 * error. The exit code of the program executed in the
919699ec
LP		 2784 * container is returned. The container argument has been set
2785 * to CONTAINER_TERMINATED.
6d416b9c
LS		 2786 * 0 : The container is being rebooted, has been shut down or exited
2787 * successfully. The container argument has been set to either
2788 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 2789 *
6d416b9c
LS		 2790 * That is, success is indicated by a return value of zero, and an
2791 * error is indicated by a non-zero value.
113cea80
DH		 2792 */
2793static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 2794 siginfo_t status;
919699ec 2795 int r;
113cea80
DH		 2796
2797 r = wait_for_terminate(pid, &status);
f647962d
MS		 2798 if (r < 0)
2799 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 2800
2801 switch (status.si_code) {
fddbb89c 2802
113cea80 2803 case CLD_EXITED:
b5a2179b 2804 if (status.si_status == 0)
919699ec 2805 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
b5a2179b 2806 else
919699ec 2807 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 2808
919699ec
LP		 2809 *container = CONTAINER_TERMINATED;
2810 return status.si_status;
113cea80
DH		 2811
2812 case CLD_KILLED:
2813 if (status.si_status == SIGINT) {
919699ec 2814 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 2815 *container = CONTAINER_TERMINATED;
919699ec
LP		 2816 return 0;
2817
113cea80 2818 } else if (status.si_status == SIGHUP) {
919699ec 2819 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 2820 *container = CONTAINER_REBOOTED;
919699ec 2821 return 0;
113cea80 2822 }
919699ec 2823
4831981d 2824 _fallthrough_;
113cea80 2825 case CLD_DUMPED:
baaa35ad
ZJS		 2826 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2827 "Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
113cea80
DH		 2828
2829 default:
baaa35ad
ZJS		 2830 return log_error_errno(SYNTHETIC_ERRNO(EIO),
2831 "Container %s failed due to unknown reason.", arg_machine);
113cea80 2832 }
113cea80
DH		 2833}
2834
023fb90b
LP		 2835static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2836 pid_t pid;
2837
4a0b58c4 2838 pid = PTR_TO_PID(userdata);
023fb90b 2839 if (pid > 0) {
c6c8f6e2 2840 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 2841 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2842 sd_event_source_set_userdata(s, NULL);
2843 return 0;
2844 }
2845 }
2846
2847 sd_event_exit(sd_event_source_get_event(s), 0);
2848 return 0;
2849}
2850
6916b164 2851static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
abdb9b08
LP		 2852 pid_t pid;
2853
2854 assert(s);
2855 assert(ssi);
2856
2857 pid = PTR_TO_PID(userdata);
2858
6916b164
AU		 2859 for (;;) {
2860 siginfo_t si = {};
abdb9b08 2861
6916b164
AU		 2862 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
2863 return log_error_errno(errno, "Failed to waitid(): %m");
2864 if (si.si_pid == 0) /* No pending children. */
2865 break;
abdb9b08 2866 if (si.si_pid == pid) {
6916b164
AU		 2867 /* The main process we care for has exited. Return from
2868 * signal handler but leave the zombie. */
2869 sd_event_exit(sd_event_source_get_event(s), 0);
2870 break;
2871 }
abdb9b08 2872
6916b164
AU		 2873 /* Reap all other children. */
2874 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
2875 }
2876
2877 return 0;
2878}
2879
abdb9b08
LP		 2880static int on_request_stop(sd_bus_message *m, void *userdata, sd_bus_error *error) {
2881 pid_t pid;
2882
2883 assert(m);
2884
2885 pid = PTR_TO_PID(userdata);
2886
2887 if (arg_kill_signal > 0) {
2888 log_info("Container termination requested. Attempting to halt container.");
2889 (void) kill(pid, arg_kill_signal);
2890 } else {
2891 log_info("Container termination requested. Exiting.");
2892 sd_event_exit(sd_bus_get_event(sd_bus_message_get_bus(m)), 0);
2893 }
2894
2895 return 0;
2896}
2897
ec16945e 2898static int determine_names(void) {
1b9cebf6 2899 int r;
ec16945e 2900
c1521918
LP		 2901 if (arg_template && !arg_directory && arg_machine) {
2902
2903 /* If --template= was specified then we should not
2904 * search for a machine, but instead create a new one
2905 * in /var/lib/machine. */
2906
657ee2d8 2907 arg_directory = path_join("/var/lib/machines", arg_machine);
c1521918
LP		 2908 if (!arg_directory)
2909 return log_oom();
2910 }
2911
ec16945e 2912 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 2913 if (arg_machine) {
2914 _cleanup_(image_unrefp) Image *i = NULL;
2915
5ef46e5f 2916 r = image_find(IMAGE_MACHINE, arg_machine, &i);
3a6ce860
LP		 2917 if (r == -ENOENT)
2918 return log_error_errno(r, "No image for machine '%s'.", arg_machine);
1b9cebf6
LP		 2919 if (r < 0)
2920 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
1b9cebf6 2921
eb38edce 2922 if (IN_SET(i->type, IMAGE_RAW, IMAGE_BLOCK))
0f03c2a4 2923 r = free_and_strdup(&arg_image, i->path);
1b9cebf6 2924 else
0f03c2a4 2925 r = free_and_strdup(&arg_directory, i->path);
1b9cebf6 2926 if (r < 0)
0f3be6ca 2927 return log_oom();
1b9cebf6 2928
aee327b8
LP		 2929 if (!arg_ephemeral)
2930 arg_read_only = arg_read_only || i->read_only;
d7249575
LP		 2931 } else {
2932 r = safe_getcwd(&arg_directory);
2933 if (r < 0)
2934 return log_error_errno(r, "Failed to determine current directory: %m");
2935 }
ec16945e 2936
c6147113
LP		 2937 if (!arg_directory && !arg_image)
2938 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine path, please use -D or -i.");
ec16945e
LP		 2939 }
2940
2941 if (!arg_machine) {
b9ba4dab
LP		 2942 if (arg_directory && path_equal(arg_directory, "/"))
2943 arg_machine = gethostname_malloc();
4827ab48
LP		 2944 else {
2945 if (arg_image) {
2946 char *e;
2947
2948 arg_machine = strdup(basename(arg_image));
2949
2950 /* Truncate suffix if there is one */
2951 e = endswith(arg_machine, ".raw");
2952 if (e)
2953 *e = 0;
2954 } else
2955 arg_machine = strdup(basename(arg_directory));
2956 }
ec16945e
LP		 2957 if (!arg_machine)
2958 return log_oom();
2959
ae691c1d 2960 hostname_cleanup(arg_machine);
c6147113
LP		 2961 if (!machine_name_is_valid(arg_machine))
2962 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine machine name automatically, please use -M.");
b9ba4dab
LP		 2963
2964 if (arg_ephemeral) {
2965 char *b;
2966
2967 /* Add a random suffix when this is an
2968 * ephemeral machine, so that we can run many
2969 * instances at once without manually having
2970 * to specify -M each time. */
2971
2972 if (asprintf(&b, "%s-%016" PRIx64, arg_machine, random_u64()) < 0)
2973 return log_oom();
2974
2975 free(arg_machine);
2976 arg_machine = b;
2977 }
ec16945e
LP		 2978 }
2979
2980 return 0;
2981}
2982
8d4aa2bb 2983static int chase_symlinks_and_update(char **p, unsigned flags) {
3f342ec4
LP		 2984 char *chased;
2985 int r;
2986
2987 assert(p);
2988
2989 if (!*p)
2990 return 0;
2991
a5648b80 2992 r = chase_symlinks(*p, NULL, flags, &chased, NULL);
3f342ec4
LP		 2993 if (r < 0)
2994 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
2995
a5648b80 2996 return free_and_replace(*p, chased);
3f342ec4
LP		 2997}
2998
03cfe0d5 2999static int determine_uid_shift(const char *directory) {
6dac160c
LP		 3000 int r;
3001
0de7acce 3002 if (arg_userns_mode == USER_NAMESPACE_NO) {
03cfe0d5 3003 arg_uid_shift = 0;
6dac160c 3004 return 0;
03cfe0d5 3005 }
6dac160c
LP		 3006
3007 if (arg_uid_shift == UID_INVALID) {
3008 struct stat st;
3009
03cfe0d5 3010 r = stat(directory, &st);
6dac160c 3011 if (r < 0)
03cfe0d5 3012 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 3013
3014 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
3015
baaa35ad
ZJS		 3016 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000)))
3017 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3018 "UID and GID base of %s don't match.", directory);
6dac160c
LP		 3019
3020 arg_uid_range = UINT32_C(0x10000);
3021 }
3022
baaa35ad
ZJS		 3023 if (arg_uid_shift > (uid_t) -1 - arg_uid_range)
3024 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
3025 "UID base too high for UID range.");
6dac160c 3026
6dac160c
LP		 3027 return 0;
3028}
3029
de40a303
LP		 3030static unsigned long effective_clone_ns_flags(void) {
3031 unsigned long flags = arg_clone_ns_flags;
3032
3033 if (arg_private_network)
3034 flags |= CLONE_NEWNET;
3035 if (arg_use_cgns)
3036 flags |= CLONE_NEWCGROUP;
3037 if (arg_userns_mode != USER_NAMESPACE_NO)
3038 flags |= CLONE_NEWUSER;
3039
3040 return flags;
3041}
3042
3043static int patch_sysctl(void) {
3044
3045 /* This table is inspired by runc's sysctl() function */
3046 static const struct {
3047 const char *key;
3048 bool prefix;
3049 unsigned long clone_flags;
3050 } safe_sysctl[] = {
3051 { "kernel.hostname", false, CLONE_NEWUTS },
3052 { "kernel.domainname", false, CLONE_NEWUTS },
3053 { "kernel.msgmax", false, CLONE_NEWIPC },
3054 { "kernel.msgmnb", false, CLONE_NEWIPC },
3055 { "kernel.msgmni", false, CLONE_NEWIPC },
3056 { "kernel.sem", false, CLONE_NEWIPC },
3057 { "kernel.shmall", false, CLONE_NEWIPC },
3058 { "kernel.shmmax", false, CLONE_NEWIPC },
3059 { "kernel.shmmni", false, CLONE_NEWIPC },
3060 { "fs.mqueue.", true, CLONE_NEWIPC },
3061 { "net.", true, CLONE_NEWNET },
3062 };
3063
3064 unsigned long flags;
3065 char **k, **v;
3066 int r;
3067
3068 flags = effective_clone_ns_flags();
3069
3070 STRV_FOREACH_PAIR(k, v, arg_sysctl) {
3071 bool good = false;
3072 size_t i;
3073
3074 for (i = 0; i < ELEMENTSOF(safe_sysctl); i++) {
3075
3076 if (!FLAGS_SET(flags, safe_sysctl[i].clone_flags))
3077 continue;
3078
3079 if (safe_sysctl[i].prefix)
3080 good = startswith(*k, safe_sysctl[i].key);
3081 else
3082 good = streq(*k, safe_sysctl[i].key);
3083
3084 if (good)
3085 break;
3086 }
3087
c6147113
LP		 3088 if (!good)
3089 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Refusing to write to sysctl '%s', as it is not safe in the selected namespaces.", *k);
de40a303
LP		 3090
3091 r = sysctl_write(*k, *v);
3092 if (r < 0)
3093 return log_error_errno(r, "Failed to write sysctl '%s': %m", *k);
3094 }
3095
3096 return 0;
3097}
3098
03cfe0d5
LP		 3099static int inner_child(
3100 Barrier *barrier,
3101 const char *directory,
3102 bool secondary,
3103 int kmsg_socket,
3104 int rtnl_socket,
3acc84eb 3105 int master_pty_socket,
e1bb4b0d
LB		 3106 FDSet *fds,
3107 char **os_release_pairs) {
69c79d3c 3108
03cfe0d5 3109 _cleanup_free_ char *home = NULL;
b5ea030d 3110 char as_uuid[ID128_UUID_STRING_MAX];
88614c8a 3111 size_t n_env = 1;
03cfe0d5 3112 const char *envp[] = {
0c300adf 3113 "PATH=" DEFAULT_PATH_COMPAT,
6aadfa4c 3114 NULL, /* container */
03cfe0d5
LP		 3115 NULL, /* TERM */
3116 NULL, /* HOME */
3117 NULL, /* USER */
3118 NULL, /* LOGNAME */
3119 NULL, /* container_uuid */
3120 NULL, /* LISTEN_FDS */
3121 NULL, /* LISTEN_PID */
9c1e04d0 3122 NULL, /* NOTIFY_SOCKET */
3652872a 3123 NULL, /* CREDENTIALS_DIRECTORY */
03cfe0d5
LP		 3124 NULL
3125 };
1a68e1e5 3126 const char *exec_target;
2371271c 3127 _cleanup_strv_free_ char **env_use = NULL;
de40a303 3128 int r, which_failed;
88213476 3129
b37469d7
LP		 3130 /* This is the "inner" child process, i.e. the one forked off by the "outer" child process, which is the one
3131 * the container manager itself forked off. At the time of clone() it gained its own CLONE_NEWNS, CLONE_NEWPID,
3132 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER namespaces. Note that it has its own CLONE_NEWNS namespace,
3133 * separate from the CLONE_NEWNS created for the "outer" child, and also separate from the host's CLONE_NEWNS
3134 * namespace. The reason for having two levels of CLONE_NEWNS namespaces is that the "inner" one is owned by
3135 * the CLONE_NEWUSER namespace of the container, while the "outer" one is owned by the host's CLONE_NEWUSER
3136 * namespace.
3137 *
3138 * Note at this point we have no CLONE_NEWNET namespace yet. We'll acquire that one later through
3139 * unshare(). See below. */
3140
03cfe0d5
LP		 3141 assert(barrier);
3142 assert(directory);
3143 assert(kmsg_socket >= 0);
88213476 3144
de40a303
LP		 3145 log_debug("Inner child is initializing.");
3146
0de7acce 3147 if (arg_userns_mode != USER_NAMESPACE_NO) {
03cfe0d5
LP		 3148 /* Tell the parent, that it now can write the UID map. */
3149 (void) barrier_place(barrier); /* #1 */
7027ff61 3150
03cfe0d5 3151 /* Wait until the parent wrote the UID map */
baaa35ad 3152 if (!barrier_place_and_sync(barrier)) /* #2 */
2a2e78e9 3153 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
88213476 3154
2a2e78e9
LP		 3155 /* Become the new root user inside our namespace */
3156 r = reset_uid_gid();
3157 if (r < 0)
3158 return log_error_errno(r, "Couldn't become new root: %m");
3159
3160 /* Creating a new user namespace means all MS_SHARED mounts become MS_SLAVE. Let's put them
3161 * back to MS_SHARED here, since that's what we want as defaults. (This will not reconnect
3162 * propagation, but simply create new peer groups for all our mounts). */
511a8cfe 3163 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SHARED|MS_REC, NULL);
2a2e78e9
LP		 3164 if (r < 0)
3165 return r;
3166 }
6d66bd3b 3167
0de7acce 3168 r = mount_all(NULL,
4f086aab 3169 arg_mount_settings | MOUNT_IN_USERNS,
0de7acce 3170 arg_uid_shift,
0de7acce 3171 arg_selinux_apifs_context);
03cfe0d5
LP		 3172 if (r < 0)
3173 return r;
3174
04413780
ZJS		 3175 if (!arg_network_namespace_path && arg_private_network) {
3176 r = unshare(CLONE_NEWNET);
3177 if (r < 0)
3178 return log_error_errno(errno, "Failed to unshare network namespace: %m");
75116558
PS		 3179
3180 /* Tell the parent that it can setup network interfaces. */
3181 (void) barrier_place(barrier); /* #3 */
04413780
ZJS		 3182 }
3183
4f086aab 3184 r = mount_sysfs(NULL, arg_mount_settings);
d8fc6a00
LP		 3185 if (r < 0)
3186 return r;
3187
03cfe0d5
LP		 3188 /* Wait until we are cgroup-ified, so that we
3189 * can mount the right cgroup path writable */
baaa35ad
ZJS		 3190 if (!barrier_place_and_sync(barrier)) /* #4 */
3191 return log_error_errno(SYNTHETIC_ERRNO(ESRCH),
3192 "Parent died too early");
88213476 3193
489fae52 3194 if (arg_use_cgns) {
0996ef00
CB		 3195 r = unshare(CLONE_NEWCGROUP);
3196 if (r < 0)
04413780 3197 return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
0996ef00
CB		 3198 r = mount_cgroups(
3199 "",
3200 arg_unified_cgroup_hierarchy,
3201 arg_userns_mode != USER_NAMESPACE_NO,
3202 arg_uid_shift,
3203 arg_uid_range,
5a8ff0e6 3204 arg_selinux_apifs_context,
ada54120 3205 true);
1433e0f2 3206 } else
0996ef00 3207 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
1433e0f2
LP		 3208 if (r < 0)
3209 return r;
ec16945e 3210
1e4f1671 3211 r = setup_boot_id();
03cfe0d5
LP		 3212 if (r < 0)
3213 return r;
ec16945e 3214
1e4f1671 3215 r = setup_kmsg(kmsg_socket);
03cfe0d5
LP		 3216 if (r < 0)
3217 return r;
3218 kmsg_socket = safe_close(kmsg_socket);
ec16945e 3219
de40a303
LP		 3220 r = mount_custom(
3221 "/",
3222 arg_custom_mounts,
3223 arg_n_custom_mounts,
de40a303
LP		 3224 0,
3225 arg_selinux_apifs_context,
5f0a6347 3226 MOUNT_NON_ROOT_ONLY | MOUNT_IN_USERNS);
de40a303
LP		 3227 if (r < 0)
3228 return r;
3229
03cfe0d5
LP		 3230 if (setsid() < 0)
3231 return log_error_errno(errno, "setsid() failed: %m");
3232
3233 if (arg_private_network)
df883de9 3234 (void) loopback_setup();
03cfe0d5 3235
7a8f6325
LP		 3236 if (arg_expose_ports) {
3237 r = expose_port_send_rtnl(rtnl_socket);
3238 if (r < 0)
3239 return r;
3240 rtnl_socket = safe_close(rtnl_socket);
3241 }
03cfe0d5 3242
3acc84eb 3243 if (arg_console_mode != CONSOLE_PIPE) {
cd132992 3244 _cleanup_close_ int master = -1;
3acc84eb
FB		 3245 _cleanup_free_ char *console = NULL;
3246
3247 /* Allocate a pty and make it available as /dev/console. */
dc98caea 3248 master = openpt_allocate(O_RDWR|O_NONBLOCK, &console);
3acc84eb 3249 if (master < 0)
dc98caea 3250 return log_error_errno(master, "Failed to allocate a pty: %m");
3acc84eb
FB		 3251
3252 r = setup_dev_console(console);
3253 if (r < 0)
105a1a36 3254 return log_error_errno(r, "Failed to set up /dev/console: %m");
3acc84eb
FB		 3255
3256 r = send_one_fd(master_pty_socket, master, 0);
3257 if (r < 0)
3258 return log_error_errno(r, "Failed to send master fd: %m");
3259 master_pty_socket = safe_close(master_pty_socket);
3260
3261 r = setup_stdio_as_dev_console();
3262 if (r < 0)
3263 return r;
3264 }
3265
de40a303
LP		 3266 r = patch_sysctl();
3267 if (r < 0)
3268 return r;
3269
81f345df
LP		 3270 if (arg_oom_score_adjust_set) {
3271 r = set_oom_score_adjust(arg_oom_score_adjust);
3272 if (r < 0)
3273 return log_error_errno(r, "Failed to adjust OOM score: %m");
3274 }
3275
0985c7c4
ZJS		 3276 if (arg_cpu_set.set)
3277 if (sched_setaffinity(0, arg_cpu_set.allocated, arg_cpu_set.set) < 0)
d107bb7d
LP		 3278 return log_error_errno(errno, "Failed to set CPU affinity: %m");
3279
c818eef1 3280 (void) setup_hostname();
03cfe0d5 3281
050f7277 3282 if (arg_personality != PERSONALITY_INVALID) {
21022b9d
LP		 3283 r = safe_personality(arg_personality);
3284 if (r < 0)
3285 return log_error_errno(r, "personality() failed: %m");
03cfe0d5 3286 } else if (secondary) {
21022b9d
LP		 3287 r = safe_personality(PER_LINUX32);
3288 if (r < 0)
3289 return log_error_errno(r, "personality() failed: %m");
03cfe0d5
LP		 3290 }
3291
de40a303
LP		 3292 r = setrlimit_closest_all((const struct rlimit *const*) arg_rlimit, &which_failed);
3293 if (r < 0)
3294 return log_error_errno(r, "Failed to apply resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3295
3296#if HAVE_SECCOMP
3297 if (arg_seccomp) {
3298
3299 if (is_seccomp_available()) {
3300
3301 r = seccomp_load(arg_seccomp);
7bc5e0b1 3302 if (ERRNO_IS_SECCOMP_FATAL(r))
de40a303
LP		 3303 return log_error_errno(r, "Failed to install seccomp filter: %m");
3304 if (r < 0)
3305 log_debug_errno(r, "Failed to install seccomp filter: %m");
3306 }
3307 } else
3308#endif
3309 {
6b000af4 3310 r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
de40a303
LP		 3311 if (r < 0)
3312 return r;
3313 }
3314
349cc4a5 3315#if HAVE_SELINUX
03cfe0d5 3316 if (arg_selinux_context)
2ed96880 3317 if (setexeccon(arg_selinux_context) < 0)
03cfe0d5
LP		 3318 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3319#endif
3320
de40a303
LP		 3321 /* Make sure we keep the caps across the uid/gid dropping, so that we can retain some selected caps
3322 * if we need to later on. */
3323 if (prctl(PR_SET_KEEPCAPS, 1) < 0)
3324 return log_error_errno(errno, "Failed to set PR_SET_KEEPCAPS: %m");
3325
3326 if (uid_is_valid(arg_uid) || gid_is_valid(arg_gid))
3462d773 3327 r = change_uid_gid_raw(arg_uid, arg_gid, arg_supplementary_gids, arg_n_supplementary_gids, arg_console_mode != CONSOLE_PIPE);
de40a303 3328 else
3462d773 3329 r = change_uid_gid(arg_user, arg_console_mode != CONSOLE_PIPE, &home);
03cfe0d5
LP		 3330 if (r < 0)
3331 return r;
3332
de40a303
LP		 3333 r = drop_capabilities(getuid());
3334 if (r < 0)
3335 return log_error_errno(r, "Dropping capabilities failed: %m");
3336
66edd963
LP		 3337 if (arg_no_new_privileges)
3338 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
3339 return log_error_errno(errno, "Failed to disable new privileges: %m");
3340
6aadfa4c
ILG		 3341 /* LXC sets container=lxc, so follow the scheme here */
3342 envp[n_env++] = strjoina("container=", arg_container_service_name);
3343
03cfe0d5
LP		 3344 envp[n_env] = strv_find_prefix(environ, "TERM=");
3345 if (envp[n_env])
313cefa1 3346 n_env++;
03cfe0d5 3347
de40a303
LP		 3348 if (home || !uid_is_valid(arg_uid) || arg_uid == 0)
3349 if (asprintf((char**)(envp + n_env++), "HOME=%s", home ?: "/root") < 0)
3350 return log_oom();
3351
3352 if (arg_user || !uid_is_valid(arg_uid) || arg_uid == 0)
3353 if (asprintf((char**)(envp + n_env++), "USER=%s", arg_user ?: "root") < 0 ||
3354 asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0)
3355 return log_oom();
03cfe0d5 3356
3bbaff3e 3357 assert(!sd_id128_is_null(arg_uuid));
03cfe0d5 3358
691675ba 3359 if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_to_uuid_string(arg_uuid, as_uuid)) < 0)
e01ff70a 3360 return log_oom();
03cfe0d5
LP		 3361
3362 if (fdset_size(fds) > 0) {
3363 r = fdset_cloexec(fds, false);
3364 if (r < 0)
3365 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
3366
3367 if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
3368 (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0))
3369 return log_oom();
3370 }
9c1e04d0
AP		 3371 if (asprintf((char **)(envp + n_env++), "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
3372 return log_oom();
03cfe0d5 3373
3652872a
LP		 3374 if (arg_n_credentials > 0) {
3375 envp[n_env] = strdup("CREDENTIALS_DIRECTORY=/run/host/credentials");
3376 if (!envp[n_env])
3377 return log_oom();
3378 n_env++;
3379 }
3380
ed4512d0 3381 env_use = strv_env_merge(3, envp, os_release_pairs, arg_setenv);
2371271c
TG		 3382 if (!env_use)
3383 return log_oom();
03cfe0d5
LP		 3384
3385 /* Let the parent know that we are ready and
3386 * wait until the parent is ready with the
3387 * setup, too... */
baaa35ad 3388 if (!barrier_place_and_sync(barrier)) /* #5 */
335d2ead 3389 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Parent died too early");
03cfe0d5 3390
5f932eb9
LP		 3391 if (arg_chdir)
3392 if (chdir(arg_chdir) < 0)
3393 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
3394
7732f92b 3395 if (arg_start_mode == START_PID2) {
75bf701f 3396 r = stub_pid1(arg_uuid);
7732f92b
LP		 3397 if (r < 0)
3398 return r;
3399 }
3400
335d2ead
LP		 3401 if (arg_console_mode != CONSOLE_PIPE) {
3402 /* So far our pty wasn't controlled by any process. Finally, it's time to change that, if we
3403 * are configured for that. Acquire it as controlling tty. */
3404 if (ioctl(STDIN_FILENO, TIOCSCTTY) < 0)
3405 return log_error_errno(errno, "Failed to acquire controlling TTY: %m");
3406 }
3407
de40a303
LP		 3408 log_debug("Inner child completed, invoking payload.");
3409
8ca082b4
LP		 3410 /* Now, explicitly close the log, so that we then can close all remaining fds. Closing the log explicitly first
3411 * has the benefit that the logging subsystem knows about it, and is thus ready to be reopened should we need
3412 * it again. Note that the other fds closed here are at least the locking and barrier fds. */
03cfe0d5 3413 log_close();
8ca082b4
LP		 3414 log_set_open_when_needed(true);
3415
03cfe0d5
LP		 3416 (void) fdset_close_others(fds);
3417
7732f92b 3418 if (arg_start_mode == START_BOOT) {
03cfe0d5
LP		 3419 char **a;
3420 size_t m;
3421
3422 /* Automatically search for the init system */
3423
75f32f04
ZJS		 3424 m = strv_length(arg_parameters);
3425 a = newa(char*, m + 2);
3426 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
3427 a[1 + m] = NULL;
03cfe0d5 3428
ced58da7 3429 a[0] = (char*) "/usr/lib/systemd/systemd";
03cfe0d5
LP		 3430 execve(a[0], a, env_use);
3431
ced58da7 3432 a[0] = (char*) "/lib/systemd/systemd";
03cfe0d5
LP		 3433 execve(a[0], a, env_use);
3434
ced58da7 3435 a[0] = (char*) "/sbin/init";
03cfe0d5 3436 execve(a[0], a, env_use);
ced58da7
LP		 3437
3438 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
1a68e1e5 3439 } else if (!strv_isempty(arg_parameters)) {
b6b180b7
LP		 3440 const char *dollar_path;
3441
1a68e1e5 3442 exec_target = arg_parameters[0];
b6b180b7
LP		 3443
3444 /* Use the user supplied search $PATH if there is one, or DEFAULT_PATH_COMPAT if not to search the
3445 * binary. */
3446 dollar_path = strv_env_get(env_use, "PATH");
3447 if (dollar_path) {
6f646e01 3448 if (setenv("PATH", dollar_path, 1) < 0)
b6b180b7
LP		 3449 return log_error_errno(errno, "Failed to update $PATH: %m");
3450 }
3451
f757855e 3452 execvpe(arg_parameters[0], arg_parameters, env_use);
1a68e1e5 3453 } else {
5f932eb9 3454 if (!arg_chdir)
d929b0f9
ZJS		 3455 /* If we cannot change the directory, we'll end up in /, that is expected. */
3456 (void) chdir(home ?: "/root");
5f932eb9 3457
03cfe0d5
LP		 3458 execle("/bin/bash", "-bash", NULL, env_use);
3459 execle("/bin/sh", "-sh", NULL, env_use);
ced58da7
LP		 3460
3461 exec_target = "/bin/bash, /bin/sh";
03cfe0d5
LP		 3462 }
3463
8ca082b4 3464 return log_error_errno(errno, "execv(%s) failed: %m", exec_target);
03cfe0d5
LP		 3465}
3466
e96ceaba 3467static int setup_notify_child(void) {
271f518f 3468 _cleanup_close_ int fd = -1;
9c1e04d0 3469 union sockaddr_union sa = {
44ed5214
LP		 3470 .un.sun_family = AF_UNIX,
3471 .un.sun_path = NSPAWN_NOTIFY_SOCKET_PATH,
9c1e04d0
AP		 3472 };
3473 int r;
3474
3475 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
3476 if (fd < 0)
3477 return log_error_errno(errno, "Failed to allocate notification socket: %m");
3478
3479 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
fbda85b0 3480 (void) sockaddr_un_unlink(&sa.un);
9c1e04d0 3481
9c1e04d0 3482 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
271f518f 3483 if (r < 0)
44ed5214 3484 return log_error_errno(errno, "bind(" NSPAWN_NOTIFY_SOCKET_PATH ") failed: %m");
9c1e04d0 3485
adc7d9f0 3486 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
271f518f 3487 if (r < 0)
adc7d9f0 3488 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
adc7d9f0 3489
2ff48e98 3490 r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
271f518f 3491 if (r < 0)
2ff48e98 3492 return log_error_errno(r, "SO_PASSCRED failed: %m");
9c1e04d0 3493
271f518f 3494 return TAKE_FD(fd);
9c1e04d0
AP		 3495}
3496
03cfe0d5
LP		 3497static int outer_child(
3498 Barrier *barrier,
3499 const char *directory,
2d845785 3500 DissectedImage *dissected_image,
03cfe0d5
LP		 3501 bool secondary,
3502 int pid_socket,
e01ff70a 3503 int uuid_socket,
9c1e04d0 3504 int notify_socket,
03cfe0d5
LP		 3505 int kmsg_socket,
3506 int rtnl_socket,
825d5287 3507 int uid_shift_socket,
3acc84eb 3508 int master_pty_socket,
8199d554 3509 int unified_cgroup_hierarchy_socket,
d7bea6b6
DP		 3510 FDSet *fds,
3511 int netns_fd) {
03cfe0d5 3512
e1bb4b0d 3513 _cleanup_strv_free_ char **os_release_pairs = NULL;
bf428efb 3514 _cleanup_close_ int fd = -1;
e5f10caf 3515 const char *p;
03cfe0d5
LP		 3516 pid_t pid;
3517 ssize_t l;
de40a303 3518 int r;
03cfe0d5 3519
b37469d7
LP		 3520 /* This is the "outer" child process, i.e the one forked off by the container manager itself. It already has
3521 * its own CLONE_NEWNS namespace (which was created by the clone()). It still lives in the host's CLONE_NEWPID,
3522 * CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER and CLONE_NEWNET namespaces. After it completed a number of
3523 * initializations a second child (the "inner" one) is forked off it, and it exits. */
3524
03cfe0d5
LP		 3525 assert(barrier);
3526 assert(directory);
03cfe0d5 3527 assert(pid_socket >= 0);
e01ff70a 3528 assert(uuid_socket >= 0);
9c1e04d0 3529 assert(notify_socket >= 0);
3acc84eb 3530 assert(master_pty_socket >= 0);
03cfe0d5
LP		 3531 assert(kmsg_socket >= 0);
3532
de40a303
LP		 3533 log_debug("Outer child is initializing.");
3534
e1bb4b0d
LB		 3535 r = load_os_release_pairs_with_prefix("/", "container_host_", &os_release_pairs);
3536 if (r < 0)
3537 log_debug_errno(r, "Failed to read os-release from host for container, ignoring: %m");
3538
03cfe0d5
LP		 3539 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
3540 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3541
03cfe0d5
LP		 3542 r = reset_audit_loginuid();
3543 if (r < 0)
3544 return r;
3545
2a2e78e9
LP		 3546 /* Mark everything as slave, so that we still receive mounts from the real root, but don't propagate
3547 * mounts to the real root. */
511a8cfe 3548 r = mount_follow_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
60e76d48
ZJS		 3549 if (r < 0)
3550 return r;
03cfe0d5 3551
2d845785 3552 if (dissected_image) {
2d3a5a73
LP		 3553 /* If we are operating on a disk image, then mount its root directory now, but leave out the rest. We
3554 * can read the UID shift from it if we need to. Further down we'll mount the rest, but then with the
3555 * uid shift known. That way we can mount VFAT file systems shifted to the right place right away. This
3556 * makes sure ESP partitions and userns are compatible. */
3557
af187ab2
LP		 3558 r = dissected_image_mount_and_warn(
3559 dissected_image, directory, arg_uid_shift,
3560 DISSECT_IMAGE_MOUNT_ROOT_ONLY|DISSECT_IMAGE_DISCARD_ON_LOOP|
3561 (arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK)|
3562 (arg_start_mode == START_BOOT ? DISSECT_IMAGE_VALIDATE_OS : 0));
2d845785 3563 if (r < 0)
af187ab2 3564 return r;
2d845785 3565 }
03cfe0d5 3566
391567f4
LP		 3567 r = determine_uid_shift(directory);
3568 if (r < 0)
3569 return r;
3570
0de7acce 3571 if (arg_userns_mode != USER_NAMESPACE_NO) {
0e7ac751 3572 /* Let the parent know which UID shift we read from the image */
825d5287
RM		 3573 l = send(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
3574 if (l < 0)
3575 return log_error_errno(errno, "Failed to send UID shift: %m");
baaa35ad
ZJS		 3576 if (l != sizeof(arg_uid_shift))
3577 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3578 "Short write while sending UID shift.");
0e7ac751 3579
0de7acce 3580 if (arg_userns_mode == USER_NAMESPACE_PICK) {
0e7ac751
LP		 3581 /* When we are supposed to pick the UID shift, the parent will check now whether the UID shift
3582 * we just read from the image is available. If yes, it will send the UID shift back to us, if
3583 * not it will pick a different one, and send it back to us. */
3584
3585 l = recv(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
3586 if (l < 0)
3587 return log_error_errno(errno, "Failed to recv UID shift: %m");
baaa35ad
ZJS		 3588 if (l != sizeof(arg_uid_shift))
3589 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3590 "Short read while receiving UID shift.");
0e7ac751
LP		 3591 }
3592
ff6c6cc1
LP		 3593 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
3594 "Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
825d5287
RM		 3595 }
3596
6f83d3d1
LP		 3597 if (path_equal(directory, "/")) {
3598 /* If the directory we shall boot is the host, let's operate on a bind mount at a different
3599 * place, so that we can make changes to its mount structure (for example, to implement
3600 * --volatile=) without this interfering with our ability to access files such as
3601 * /etc/localtime to copy into the container. Note that we use a fixed place for this
3602 * (instead of a temporary directory, since we are living in our own mount namspace here
3603 * already, and thus don't need to be afraid of colliding with anyone else's mounts).*/
3604 (void) mkdir_p("/run/systemd/nspawn-root", 0755);
3605
511a8cfe 3606 r = mount_nofollow_verbose(LOG_ERR, "/", "/run/systemd/nspawn-root", NULL, MS_BIND|MS_REC, NULL);
6f83d3d1
LP		 3607 if (r < 0)
3608 return r;
3609
3610 directory = "/run/systemd/nspawn-root";
e50cd82f 3611 }
7d0ecdd6
LP		 3612
3613 r = setup_pivot_root(
3614 directory,
3615 arg_pivot_root_new,
3616 arg_pivot_root_old);
3617 if (r < 0)
3618 return r;
3619
3620 r = setup_volatile_mode(
3621 directory,
3622 arg_volatile_mode,
7d0ecdd6 3623 arg_uid_shift,
8f1ed04a 3624 arg_selinux_apifs_context);
7d0ecdd6
LP		 3625 if (r < 0)
3626 return r;
3627
5f0a6347
DDM		 3628 r = mount_custom(
3629 directory,
3630 arg_custom_mounts,
3631 arg_n_custom_mounts,
5f0a6347 3632 arg_uid_shift,
5f0a6347
DDM		 3633 arg_selinux_apifs_context,
3634 MOUNT_ROOT_ONLY);
3635 if (r < 0)
3636 return r;
3637
5530dc87
DDM		 3638 /* Make sure we always have a mount that we can move to root later on. */
3639 if (!path_is_mount_point(directory, NULL, 0)) {
511a8cfe 3640 r = mount_nofollow_verbose(LOG_ERR, directory, directory, NULL, MS_BIND|MS_REC, NULL);
5530dc87
DDM		 3641 if (r < 0)
3642 return r;
3643 }
3644
2d3a5a73
LP		 3645 if (dissected_image) {
3646 /* Now we know the uid shift, let's now mount everything else that might be in the image. */
3647 r = dissected_image_mount(dissected_image, directory, arg_uid_shift,
4fcb96ce
LP		 3648 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY|DISSECT_IMAGE_DISCARD_ON_LOOP|(arg_read_only ? DISSECT_IMAGE_READ_ONLY : DISSECT_IMAGE_FSCK));
3649 if (r == -EUCLEAN)
3650 return log_error_errno(r, "File system check for image failed: %m");
2d3a5a73 3651 if (r < 0)
4fcb96ce 3652 return log_error_errno(r, "Failed to mount image file system: %m");
2d3a5a73
LP		 3653 }
3654
8199d554
LP		 3655 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
3656 /* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
3657
3658 r = detect_unified_cgroup_hierarchy_from_image(directory);
3659 if (r < 0)
3660 return r;
3661
3662 l = send(unified_cgroup_hierarchy_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
3663 if (l < 0)
3664 return log_error_errno(errno, "Failed to send cgroup mode: %m");
baaa35ad
ZJS		 3665 if (l != sizeof(arg_unified_cgroup_hierarchy))
3666 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3667 "Short write while sending cgroup mode.");
8199d554
LP		 3668
3669 unified_cgroup_hierarchy_socket = safe_close(unified_cgroup_hierarchy_socket);
3670 }
3671
4ad14eff
LP		 3672 /* Mark everything as shared so our mounts get propagated down. This is
3673 * required to make new bind mounts available in systemd services
5238e957 3674 * inside the container that create a new mount namespace.
4ad14eff
LP		 3675 * See https://github.com/systemd/systemd/issues/3860
3676 * Further submounts (such as /dev) done after this will inherit the
5f0a6347
DDM		 3677 * shared propagation mode.
3678 *
3679 * IMPORTANT: Do not overmount the root directory anymore from now on to
3680 * enable moving the root directory mount to root later on.
3681 * https://github.com/systemd/systemd/issues/3847#issuecomment-562735251
3682 */
511a8cfe 3683 r = mount_nofollow_verbose(LOG_ERR, NULL, directory, NULL, MS_SHARED|MS_REC, NULL);
4ad14eff
LP		 3684 if (r < 0)
3685 return r;
3686
3687 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
3688 if (r < 0)
3689 return r;
3690
03cfe0d5
LP		 3691 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
3692 if (r < 0)
3693 return r;
3694
bbd407ea
DDM		 3695 if (arg_read_only && arg_volatile_mode == VOLATILE_NO &&
3696 !has_custom_root_mount(arg_custom_mounts, arg_n_custom_mounts)) {
64e82c19 3697 r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
03cfe0d5
LP		 3698 if (r < 0)
3699 return log_error_errno(r, "Failed to make tree read-only: %m");
3700 }
3701
0de7acce 3702 r = mount_all(directory,
4f086aab 3703 arg_mount_settings,
0de7acce 3704 arg_uid_shift,
0de7acce 3705 arg_selinux_apifs_context);
03cfe0d5
LP		 3706 if (r < 0)
3707 return r;
3708
07fa00f9
LP		 3709 r = copy_devnodes(directory);
3710 if (r < 0)
03cfe0d5
LP		 3711 return r;
3712
de40a303
LP		 3713 r = make_extra_nodes(directory);
3714 if (r < 0)
3715 return r;
3716
3717 (void) dev_setup(directory, arg_uid_shift, arg_uid_shift);
e5f10caf 3718
9fac5029 3719 p = prefix_roota(directory, "/run/host");
e5f10caf 3720 (void) make_inaccessible_nodes(p, arg_uid_shift, arg_uid_shift);
03cfe0d5 3721
07fa00f9
LP		 3722 r = setup_pts(directory);
3723 if (r < 0)
03cfe0d5
LP		 3724 return r;
3725
3726 r = setup_propagate(directory);
3727 if (r < 0)
3728 return r;
3729
8e5430c4
LP		 3730 r = setup_keyring();
3731 if (r < 0)
3732 return r;
3733
3652872a
LP		 3734 r = setup_credentials(directory);
3735 if (r < 0)
3736 return r;
3737
5c4deb9a
MJ		 3738 r = mount_custom(
3739 directory,
3740 arg_custom_mounts,
3741 arg_n_custom_mounts,
3742 arg_uid_shift,
3743 arg_selinux_apifs_context,
3744 MOUNT_NON_ROOT_ONLY);
3745 if (r < 0)
3746 return r;
3747
03cfe0d5
LP		 3748 r = setup_timezone(directory);
3749 if (r < 0)
3750 return r;
3751
3752 r = setup_resolv_conf(directory);
3753 if (r < 0)
3754 return r;
3755
e01ff70a
MS		 3756 r = setup_machine_id(directory);
3757 if (r < 0)
3758 return r;
3759
03cfe0d5
LP		 3760 r = setup_journal(directory);
3761 if (r < 0)
3762 return r;
3763
0f48ba7b
LP		 3764 /* The same stuff as the $container env var, but nicely readable for the entire payload */
3765 p = prefix_roota(directory, "/run/host/container-manager");
3766 (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE);
3767
3768 /* The same stuff as the $container_uuid env var */
3769 p = prefix_roota(directory, "/run/host/container-uuid");
3770 (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
3771
489fae52 3772 if (!arg_use_cgns) {
0996ef00
CB		 3773 r = mount_cgroups(
3774 directory,
3775 arg_unified_cgroup_hierarchy,
3776 arg_userns_mode != USER_NAMESPACE_NO,
3777 arg_uid_shift,
3778 arg_uid_range,
5a8ff0e6 3779 arg_selinux_apifs_context,
ada54120 3780 false);
0996ef00
CB		 3781 if (r < 0)
3782 return r;
3783 }
03cfe0d5
LP		 3784
3785 r = mount_move_root(directory);
3786 if (r < 0)
3787 return log_error_errno(r, "Failed to move root directory: %m");
3788
e96ceaba 3789 fd = setup_notify_child();
9c1e04d0
AP		 3790 if (fd < 0)
3791 return fd;
3792
03cfe0d5 3793 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
0c582db0 3794 arg_clone_ns_flags |
8869a0b4 3795 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
03cfe0d5
LP		 3796 if (pid < 0)
3797 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5
LP		 3798 if (pid == 0) {
3799 pid_socket = safe_close(pid_socket);
e01ff70a 3800 uuid_socket = safe_close(uuid_socket);
9c1e04d0 3801 notify_socket = safe_close(notify_socket);
825d5287 3802 uid_shift_socket = safe_close(uid_shift_socket);
03cfe0d5 3803
2a2e78e9
LP		 3804 /* The inner child has all namespaces that are requested, so that we all are owned by the
3805 * user if user namespaces are turned on. */
03cfe0d5 3806
d7bea6b6
DP		 3807 if (arg_network_namespace_path) {
3808 r = namespace_enter(-1, -1, netns_fd, -1, -1);
3809 if (r < 0)
e2d39e54 3810 return log_error_errno(r, "Failed to join network namespace: %m");
d7bea6b6
DP		 3811 }
3812
e1bb4b0d 3813 r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, master_pty_socket, fds, os_release_pairs);
03cfe0d5
LP		 3814 if (r < 0)
3815 _exit(EXIT_FAILURE);
3816
3817 _exit(EXIT_SUCCESS);
3818 }
3819
3820 l = send(pid_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
3821 if (l < 0)
3822 return log_error_errno(errno, "Failed to send PID: %m");
baaa35ad
ZJS		 3823 if (l != sizeof(pid))
3824 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3825 "Short write while sending PID.");
03cfe0d5 3826
e01ff70a
MS		 3827 l = send(uuid_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
3828 if (l < 0)
3829 return log_error_errno(errno, "Failed to send machine ID: %m");
baaa35ad
ZJS		 3830 if (l != sizeof(arg_uuid))
3831 return log_error_errno(SYNTHETIC_ERRNO(EIO),
3832 "Short write while sending machine ID.");
e01ff70a 3833
9c1e04d0
AP		 3834 l = send_one_fd(notify_socket, fd, 0);
3835 if (l < 0)
ba72801d 3836 return log_error_errno(l, "Failed to send notify fd: %m");
9c1e04d0 3837
03cfe0d5 3838 pid_socket = safe_close(pid_socket);
e01ff70a 3839 uuid_socket = safe_close(uuid_socket);
9c1e04d0 3840 notify_socket = safe_close(notify_socket);
3acc84eb 3841 master_pty_socket = safe_close(master_pty_socket);
327e26d6
KN		 3842 kmsg_socket = safe_close(kmsg_socket);
3843 rtnl_socket = safe_close(rtnl_socket);
d7bea6b6 3844 netns_fd = safe_close(netns_fd);
03cfe0d5
LP		 3845
3846 return 0;
3847}
3848
0e7ac751 3849static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
d381c8a6 3850 bool tried_hashed = false;
0e7ac751
LP		 3851 unsigned n_tries = 100;
3852 uid_t candidate;
3853 int r;
3854
3855 assert(shift);
3856 assert(ret_lock_file);
0de7acce 3857 assert(arg_userns_mode == USER_NAMESPACE_PICK);
0e7ac751
LP		 3858 assert(arg_uid_range == 0x10000U);
3859
3860 candidate = *shift;
3861
3862 (void) mkdir("/run/systemd/nspawn-uid", 0755);
3863
3864 for (;;) {
fbd0b64f 3865 char lock_path[STRLEN("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
8e766630 3866 _cleanup_(release_lock_file) LockFile lf = LOCK_FILE_INIT;
0e7ac751
LP		 3867
3868 if (--n_tries <= 0)
3869 return -EBUSY;
3870
87d5e4f2 3871 if (candidate < CONTAINER_UID_BASE_MIN || candidate > CONTAINER_UID_BASE_MAX)
0e7ac751
LP		 3872 goto next;
3873 if ((candidate & UINT32_C(0xFFFF)) != 0)
3874 goto next;
3875
3876 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
3877 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
3878 if (r == -EBUSY) /* Range already taken by another nspawn instance */
3879 goto next;
3880 if (r < 0)
3881 return r;
3882
3883 /* Make some superficial checks whether the range is currently known in the user database */
3884 if (getpwuid(candidate))
3885 goto next;
3886 if (getpwuid(candidate + UINT32_C(0xFFFE)))
3887 goto next;
3888 if (getgrgid(candidate))
3889 goto next;
3890 if (getgrgid(candidate + UINT32_C(0xFFFE)))
3891 goto next;
3892
3893 *ret_lock_file = lf;
3894 lf = (struct LockFile) LOCK_FILE_INIT;
3895 *shift = candidate;
3896 return 0;
3897
3898 next:
d381c8a6
LP		 3899 if (arg_machine && !tried_hashed) {
3900 /* Try to hash the base from the container name */
3901
3902 static const uint8_t hash_key[] = {
3903 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
3904 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
3905 };
3906
3907 candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
3908
3909 tried_hashed = true;
3910 } else
3911 random_bytes(&candidate, sizeof(candidate));
3912
87d5e4f2 3913 candidate = (candidate % (CONTAINER_UID_BASE_MAX - CONTAINER_UID_BASE_MIN)) + CONTAINER_UID_BASE_MIN;
0e7ac751
LP		 3914 candidate &= (uid_t) UINT32_C(0xFFFF0000);
3915 }
3916}
3917
03cfe0d5 3918static int setup_uid_map(pid_t pid) {
fbd0b64f 3919 char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1], line[DECIMAL_STR_MAX(uid_t)*3+3+1];
03cfe0d5
LP		 3920 int r;
3921
3922 assert(pid > 1);
3923
3924 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
3925 xsprintf(line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, arg_uid_shift, arg_uid_range);
57512c89 3926 r = write_string_file(uid_map, line, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 3927 if (r < 0)
3928 return log_error_errno(r, "Failed to write UID map: %m");
3929
3930 /* We always assign the same UID and GID ranges */
3931 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
57512c89 3932 r = write_string_file(uid_map, line, WRITE_STRING_FILE_DISABLE_BUFFER);
03cfe0d5
LP		 3933 if (r < 0)
3934 return log_error_errno(r, "Failed to write GID map: %m");
3935
3936 return 0;
3937}
3938
9c1e04d0 3939static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
9c1e04d0
AP		 3940 char buf[NOTIFY_BUFFER_MAX+1];
3941 char *p = NULL;
3942 struct iovec iovec = {
3943 .iov_base = buf,
3944 .iov_len = sizeof(buf)-1,
3945 };
fb29cdbe
LP		 3946 CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
3947 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)) control;
9c1e04d0
AP		 3948 struct msghdr msghdr = {
3949 .msg_iov = &iovec,
3950 .msg_iovlen = 1,
3951 .msg_control = &control,
3952 .msg_controllen = sizeof(control),
3953 };
371d72e0 3954 struct ucred *ucred;
9c1e04d0
AP		 3955 ssize_t n;
3956 pid_t inner_child_pid;
3957 _cleanup_strv_free_ char **tags = NULL;
3958
3959 assert(userdata);
3960
3961 inner_child_pid = PTR_TO_PID(userdata);
3962
3963 if (revents != EPOLLIN) {
3964 log_warning("Got unexpected poll event for notify fd.");
3965 return 0;
3966 }
3967
3691bcf3
LP		 3968 n = recvmsg_safe(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
3969 if (IN_SET(n, -EAGAIN, -EINTR))
3970 return 0;
3971 if (n < 0)
3972 return log_warning_errno(n, "Couldn't read notification socket: %m");
9c1e04d0 3973
9c1e04d0
AP		 3974 cmsg_close_all(&msghdr);
3975
371d72e0 3976 ucred = CMSG_FIND_DATA(&msghdr, SOL_SOCKET, SCM_CREDENTIALS, struct ucred);
9c1e04d0 3977 if (!ucred || ucred->pid != inner_child_pid) {
8cb57430 3978 log_debug("Received notify message without valid credentials. Ignoring.");
9c1e04d0
AP		 3979 return 0;
3980 }
3981
3982 if ((size_t) n >= sizeof(buf)) {
3983 log_warning("Received notify message exceeded maximum size. Ignoring.");
3984 return 0;
3985 }
3986
3987 buf[n] = 0;
3988 tags = strv_split(buf, "\n\r");
3989 if (!tags)
3990 return log_oom();
3991
3992 if (strv_find(tags, "READY=1"))
04f590a4 3993 (void) sd_notifyf(false, "READY=1\n");
9c1e04d0
AP		 3994
3995 p = strv_find_startswith(tags, "STATUS=");
3996 if (p)
04f590a4 3997 (void) sd_notifyf(false, "STATUS=Container running: %s", p);
9c1e04d0
AP		 3998
3999 return 0;
4000}
4001
e96ceaba 4002static int setup_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
9c1e04d0 4003 int r;
9c1e04d0 4004
5773024d 4005 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
9c1e04d0
AP		 4006 if (r < 0)
4007 return log_error_errno(r, "Failed to allocate notify event source: %m");
4008
5773024d 4009 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
9c1e04d0
AP		 4010
4011 return 0;
4012}
4013
5d961407
LP		 4014static int merge_settings(Settings *settings, const char *path) {
4015 int rl;
f757855e 4016
5d961407
LP		 4017 assert(settings);
4018 assert(path);
f757855e 4019
5d961407
LP		 4020 /* Copy over bits from the settings, unless they have been explicitly masked by command line switches. Note
4021 * that this steals the fields of the Settings* structure, and hence modifies it. */
f757855e 4022
7732f92b
LP		 4023 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
4024 settings->start_mode >= 0) {
4025 arg_start_mode = settings->start_mode;
130d3d22 4026 strv_free_and_replace(arg_parameters, settings->parameters);
f757855e
LP		 4027 }
4028
a2f577fc
JL		 4029 if ((arg_settings_mask & SETTING_EPHEMERAL) == 0)
4030 arg_ephemeral = settings->ephemeral;
4031
de40a303
LP		 4032 if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
4033 settings->root) {
4034
4035 if (!arg_settings_trusted)
4036 log_warning("Ignoring root directory setting, file %s is not trusted.", path);
4037 else
4038 free_and_replace(arg_directory, settings->root);
4039 }
4040
b53ede69
PW		 4041 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
4042 settings->pivot_root_new) {
4043 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
4044 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
4045 }
4046
5f932eb9 4047 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
1cc6c93a
YW		 4048 settings->working_directory)
4049 free_and_replace(arg_chdir, settings->working_directory);
5f932eb9 4050
f757855e 4051 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
130d3d22
YW		 4052 settings->environment)
4053 strv_free_and_replace(arg_setenv, settings->environment);
f757855e 4054
de40a303
LP		 4055 if ((arg_settings_mask & SETTING_USER) == 0) {
4056
4057 if (settings->user)
4058 free_and_replace(arg_user, settings->user);
4059
4060 if (uid_is_valid(settings->uid))
4061 arg_uid = settings->uid;
4062 if (gid_is_valid(settings->gid))
4063 arg_gid = settings->gid;
4064 if (settings->n_supplementary_gids > 0) {
4065 free_and_replace(arg_supplementary_gids, settings->supplementary_gids);
4066 arg_n_supplementary_gids = settings->n_supplementary_gids;
4067 }
4068 }
f757855e
LP		 4069
4070 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
a3fc6b55 4071 uint64_t plus, minus;
7be830c6 4072 uint64_t network_minus = 0;
f757855e 4073
de40a303
LP		 4074 /* Note that we copy both the simple plus/minus caps here, and the full quintet from the
4075 * Settings structure */
4076
0e265674 4077 plus = settings->capability;
a3fc6b55
LP		 4078 minus = settings->drop_capability;
4079
4080 if ((arg_settings_mask & SETTING_NETWORK) == 0) {
4081 if (settings_private_network(settings))
4082 plus |= UINT64_C(1) << CAP_NET_ADMIN;
4083 else
7be830c6 4084 network_minus |= UINT64_C(1) << CAP_NET_ADMIN;
a3fc6b55 4085 }
0e265674
LP		 4086
4087 if (!arg_settings_trusted && plus != 0) {
4088 if (settings->capability != 0)
5d961407 4089 log_warning("Ignoring Capability= setting, file %s is not trusted.", path);
7be830c6
TH		 4090 } else {
4091 arg_caps_retain &= ~network_minus;
520e0d54 4092 arg_caps_retain |= plus;
7be830c6 4093 }
f757855e 4094
a3fc6b55 4095 arg_caps_retain &= ~minus;
de40a303
LP		 4096
4097 /* Copy the full capabilities over too */
4098 if (capability_quintet_is_set(&settings->full_capabilities)) {
4099 if (!arg_settings_trusted)
5238e957 4100 log_warning("Ignoring capability settings, file %s is not trusted.", path);
de40a303
LP		 4101 else
4102 arg_full_capabilities = settings->full_capabilities;
4103 }
f757855e
LP		 4104 }
4105
4106 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
4107 settings->kill_signal > 0)
4108 arg_kill_signal = settings->kill_signal;
4109
4110 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
4111 settings->personality != PERSONALITY_INVALID)
4112 arg_personality = settings->personality;
4113
4114 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
4115 !sd_id128_is_null(settings->machine_id)) {
4116
4117 if (!arg_settings_trusted)
5d961407 4118 log_warning("Ignoring MachineID= setting, file %s is not trusted.", path);
f757855e
LP		 4119 else
4120 arg_uuid = settings->machine_id;
4121 }
4122
4123 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
4124 settings->read_only >= 0)
4125 arg_read_only = settings->read_only;
4126
4127 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
4128 settings->volatile_mode != _VOLATILE_MODE_INVALID)
4129 arg_volatile_mode = settings->volatile_mode;
4130
4131 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
4132 settings->n_custom_mounts > 0) {
4133
4134 if (!arg_settings_trusted)
5d961407 4135 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", path);
f757855e
LP		 4136 else {
4137 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
1cc6c93a 4138 arg_custom_mounts = TAKE_PTR(settings->custom_mounts);
f757855e 4139 arg_n_custom_mounts = settings->n_custom_mounts;
f757855e
LP		 4140 settings->n_custom_mounts = 0;
4141 }
4142 }
4143
4144 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
4145 (settings->private_network >= 0 ||
4146 settings->network_veth >= 0 ||
4147 settings->network_bridge ||
22b28dfd 4148 settings->network_zone ||
f757855e
LP		 4149 settings->network_interfaces ||
4150 settings->network_macvlan ||
f6d6bad1 4151 settings->network_ipvlan ||
de40a303
LP		 4152 settings->network_veth_extra ||
4153 settings->network_namespace_path)) {
f757855e
LP		 4154
4155 if (!arg_settings_trusted)
5d961407 4156 log_warning("Ignoring network settings, file %s is not trusted.", path);
f757855e 4157 else {
f6d6bad1 4158 arg_network_veth = settings_network_veth(settings);
0e265674
LP		 4159 arg_private_network = settings_private_network(settings);
4160
130d3d22
YW		 4161 strv_free_and_replace(arg_network_interfaces, settings->network_interfaces);
4162 strv_free_and_replace(arg_network_macvlan, settings->network_macvlan);
4163 strv_free_and_replace(arg_network_ipvlan, settings->network_ipvlan);
4164 strv_free_and_replace(arg_network_veth_extra, settings->network_veth_extra);
f6d6bad1 4165
1cc6c93a
YW		 4166 free_and_replace(arg_network_bridge, settings->network_bridge);
4167 free_and_replace(arg_network_zone, settings->network_zone);
de40a303
LP		 4168
4169 free_and_replace(arg_network_namespace_path, settings->network_namespace_path);
f757855e
LP		 4170 }
4171 }
4172
4173 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
4174 settings->expose_ports) {
4175
4176 if (!arg_settings_trusted)
5d961407 4177 log_warning("Ignoring Port= setting, file %s is not trusted.", path);
f757855e
LP		 4178 else {
4179 expose_port_free_all(arg_expose_ports);
1cc6c93a 4180 arg_expose_ports = TAKE_PTR(settings->expose_ports);
f757855e
LP		 4181 }
4182 }
4183
0de7acce
LP		 4184 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
4185 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
4186
4187 if (!arg_settings_trusted)
5d961407 4188 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", path);
0de7acce
LP		 4189 else {
4190 arg_userns_mode = settings->userns_mode;
4191 arg_uid_shift = settings->uid_shift;
4192 arg_uid_range = settings->uid_range;
4193 arg_userns_chown = settings->userns_chown;
4194 }
4195 }
4196
9c1e04d0
AP		 4197 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0)
4198 arg_notify_ready = settings->notify_ready;
4199
960e4569
LP		 4200 if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
4201
6b000af4 4202 if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
5d961407 4203 log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
960e4569 4204 else {
6b000af4
LP		 4205 strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
4206 strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
960e4569 4207 }
de40a303
LP		 4208
4209#if HAVE_SECCOMP
4210 if (!arg_settings_trusted && settings->seccomp)
4211 log_warning("Ignoring SECCOMP filter, file %s is not trusted.", path);
4212 else {
4213 seccomp_release(arg_seccomp);
4214 arg_seccomp = TAKE_PTR(settings->seccomp);
4215 }
4216#endif
960e4569
LP		 4217 }
4218
bf428efb
LP		 4219 for (rl = 0; rl < _RLIMIT_MAX; rl ++) {
4220 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)))
4221 continue;
4222
4223 if (!settings->rlimit[rl])
4224 continue;
4225
4226 if (!arg_settings_trusted) {
5d961407 4227 log_warning("Ignoring Limit%s= setting, file '%s' is not trusted.", rlimit_to_string(rl), path);
bf428efb
LP		 4228 continue;
4229 }
4230
4231 free_and_replace(arg_rlimit[rl], settings->rlimit[rl]);
4232 }
4233
3a9530e5
LP		 4234 if ((arg_settings_mask & SETTING_HOSTNAME) == 0 &&
4235 settings->hostname)
4236 free_and_replace(arg_hostname, settings->hostname);
4237
66edd963
LP		 4238 if ((arg_settings_mask & SETTING_NO_NEW_PRIVILEGES) == 0 &&
4239 settings->no_new_privileges >= 0)
4240 arg_no_new_privileges = settings->no_new_privileges;
4241
81f345df
LP		 4242 if ((arg_settings_mask & SETTING_OOM_SCORE_ADJUST) == 0 &&
4243 settings->oom_score_adjust_set) {
4244
4245 if (!arg_settings_trusted)
5d961407 4246 log_warning("Ignoring OOMScoreAdjust= setting, file '%s' is not trusted.", path);
81f345df
LP		 4247 else {
4248 arg_oom_score_adjust = settings->oom_score_adjust;
4249 arg_oom_score_adjust_set = true;
4250 }
4251 }
4252
d107bb7d 4253 if ((arg_settings_mask & SETTING_CPU_AFFINITY) == 0 &&
0985c7c4 4254 settings->cpu_set.set) {
d107bb7d
LP		 4255
4256 if (!arg_settings_trusted)
5d961407 4257 log_warning("Ignoring CPUAffinity= setting, file '%s' is not trusted.", path);
d107bb7d 4258 else {
0985c7c4
ZJS		 4259 cpu_set_reset(&arg_cpu_set);
4260 arg_cpu_set = settings->cpu_set;
4261 settings->cpu_set = (CPUSet) {};
d107bb7d
LP		 4262 }
4263 }
4264
09d423e9
LP		 4265 if ((arg_settings_mask & SETTING_RESOLV_CONF) == 0 &&
4266 settings->resolv_conf != _RESOLV_CONF_MODE_INVALID)
4267 arg_resolv_conf = settings->resolv_conf;
4268
4e1d6aa9
LP		 4269 if ((arg_settings_mask & SETTING_LINK_JOURNAL) == 0 &&
4270 settings->link_journal != _LINK_JOURNAL_INVALID) {
4271
4272 if (!arg_settings_trusted)
4273 log_warning("Ignoring journal link setting, file '%s' is not trusted.", path);
4274 else {
4275 arg_link_journal = settings->link_journal;
4276 arg_link_journal_try = settings->link_journal_try;
4277 }
4278 }
4279
1688841f
LP		 4280 if ((arg_settings_mask & SETTING_TIMEZONE) == 0 &&
4281 settings->timezone != _TIMEZONE_MODE_INVALID)
4282 arg_timezone = settings->timezone;
4283
de40a303
LP		 4284 if ((arg_settings_mask & SETTING_SLICE) == 0 &&
4285 settings->slice) {
4286
4287 if (!arg_settings_trusted)
4288 log_warning("Ignoring slice setting, file '%s' is not trusted.", path);
4289 else
4290 free_and_replace(arg_slice, settings->slice);
4291 }
4292
4293 if ((arg_settings_mask & SETTING_USE_CGNS) == 0 &&
4294 settings->use_cgns >= 0) {
4295
4296 if (!arg_settings_trusted)
4297 log_warning("Ignoring cgroup namespace setting, file '%s' is not trusted.", path);
4298 else
4299 arg_use_cgns = settings->use_cgns;
4300 }
4301
4302 if ((arg_settings_mask & SETTING_CLONE_NS_FLAGS) == 0 &&
4303 settings->clone_ns_flags != (unsigned long) -1) {
4304
4305 if (!arg_settings_trusted)
4306 log_warning("Ignoring namespace setting, file '%s' is not trusted.", path);
4307 else
4308 arg_clone_ns_flags = settings->clone_ns_flags;
4309 }
4310
4311 if ((arg_settings_mask & SETTING_CONSOLE_MODE) == 0 &&
4312 settings->console_mode >= 0) {
4313
4314 if (!arg_settings_trusted)
4315 log_warning("Ignoring console mode setting, file '%s' is not trusted.", path);
4316 else
4317 arg_console_mode = settings->console_mode;
4318 }
4319
4320 /* The following properties can only be set through the OCI settings logic, not from the command line, hence we
4321 * don't consult arg_settings_mask for them. */
4322
4323 sd_bus_message_unref(arg_property_message);
4324 arg_property_message = TAKE_PTR(settings->properties);
4325
4326 arg_console_width = settings->console_width;
4327 arg_console_height = settings->console_height;
4328
b2645747 4329 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
de40a303
LP		 4330 arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
4331 arg_n_extra_nodes = settings->n_extra_nodes;
4332
f757855e
LP		 4333 return 0;
4334}
4335
5d961407
LP		 4336static int load_settings(void) {
4337 _cleanup_(settings_freep) Settings *settings = NULL;
4338 _cleanup_fclose_ FILE *f = NULL;
4339 _cleanup_free_ char *p = NULL;
4340 const char *fn, *i;
4341 int r;
4342
de40a303
LP		 4343 if (arg_oci_bundle)
4344 return 0;
4345
5d961407
LP		 4346 /* If all settings are masked, there's no point in looking for
4347 * the settings file */
d7a0f1f4 4348 if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
5d961407
LP		 4349 return 0;
4350
4351 fn = strjoina(arg_machine, ".nspawn");
4352
4353 /* We first look in the admin's directories in /etc and /run */
4354 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
4355 _cleanup_free_ char *j = NULL;
4356
657ee2d8 4357 j = path_join(i, fn);
5d961407
LP		 4358 if (!j)
4359 return log_oom();
4360
4361 f = fopen(j, "re");
4362 if (f) {
4363 p = TAKE_PTR(j);
4364
4365 /* By default, we trust configuration from /etc and /run */
4366 if (arg_settings_trusted < 0)
4367 arg_settings_trusted = true;
4368
4369 break;
4370 }
4371
4372 if (errno != ENOENT)
4373 return log_error_errno(errno, "Failed to open %s: %m", j);
4374 }
4375
4376 if (!f) {
4377 /* After that, let's look for a file next to the
4378 * actual image we shall boot. */
4379
4380 if (arg_image) {
4381 p = file_in_same_dir(arg_image, fn);
4382 if (!p)
4383 return log_oom();
cd6e3914 4384 } else if (arg_directory && !path_equal(arg_directory, "/")) {
5d961407
LP		 4385 p = file_in_same_dir(arg_directory, fn);
4386 if (!p)
4387 return log_oom();
4388 }
4389
4390 if (p) {
4391 f = fopen(p, "re");
4392 if (!f && errno != ENOENT)
4393 return log_error_errno(errno, "Failed to open %s: %m", p);
4394
4395 /* By default, we do not trust configuration from /var/lib/machines */
4396 if (arg_settings_trusted < 0)
4397 arg_settings_trusted = false;
4398 }
4399 }
4400
4401 if (!f)
4402 return 0;
4403
4404 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
4405
4406 r = settings_load(f, p, &settings);
4407 if (r < 0)
4408 return r;
4409
4410 return merge_settings(settings, p);
4411}
4412
de40a303
LP		 4413static int load_oci_bundle(void) {
4414 _cleanup_(settings_freep) Settings *settings = NULL;
4415 int r;
4416
4417 if (!arg_oci_bundle)
4418 return 0;
4419
4420 /* By default let's trust OCI bundles */
4421 if (arg_settings_trusted < 0)
4422 arg_settings_trusted = true;
4423
4424 r = oci_load(NULL, arg_oci_bundle, &settings);
4425 if (r < 0)
4426 return r;
4427
4428 return merge_settings(settings, arg_oci_bundle);
4429}
4430
3acc84eb 4431static int run_container(
2d845785 4432 DissectedImage *dissected_image,
b0067625
ZJS		 4433 bool secondary,
4434 FDSet *fds,
4435 char veth_name[IFNAMSIZ], bool *veth_created,
4436 union in_addr_union *exposed,
3acc84eb 4437 int *master, pid_t *pid, int *ret) {
b0067625
ZJS		 4438
4439 static const struct sigaction sa = {
4440 .sa_handler = nop_signal_handler,
e28c7cd0 4441 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
b0067625
ZJS		 4442 };
4443
8e766630 4444 _cleanup_(release_lock_file) LockFile uid_shift_lock = LOCK_FILE_INIT;
b0067625
ZJS		 4445 _cleanup_close_ int etc_passwd_lock = -1;
4446 _cleanup_close_pair_ int
4447 kmsg_socket_pair[2] = { -1, -1 },
4448 rtnl_socket_pair[2] = { -1, -1 },
4449 pid_socket_pair[2] = { -1, -1 },
4450 uuid_socket_pair[2] = { -1, -1 },
4451 notify_socket_pair[2] = { -1, -1 },
8199d554 4452 uid_shift_socket_pair[2] = { -1, -1 },
3acc84eb 4453 master_pty_socket_pair[2] = { -1, -1 },
8199d554
LP		 4454 unified_cgroup_hierarchy_socket_pair[2] = { -1, -1};
4455
3acc84eb 4456 _cleanup_close_ int notify_socket = -1;
b0067625 4457 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
5773024d 4458 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
b0067625
ZJS		 4459 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
4460 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4461 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
abdb9b08 4462 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
b0067625 4463 ContainerStatus container_status = 0;
b0067625
ZJS		 4464 int ifi = 0, r;
4465 ssize_t l;
4466 sigset_t mask_chld;
5b4855ab 4467 _cleanup_close_ int child_netns_fd = -1;
b0067625
ZJS		 4468
4469 assert_se(sigemptyset(&mask_chld) == 0);
4470 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4471
4472 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4473 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
4474 * check with getpwuid() if the specific user already exists. Note that /etc might be
4475 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
4476 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
4477 * really just an extra safety net. We kinda assume that the UID range we allocate from is
4478 * really ours. */
4479
4480 etc_passwd_lock = take_etc_passwd_lock(NULL);
4481 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
4482 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
4483 }
4484
4485 r = barrier_create(&barrier);
4486 if (r < 0)
4487 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
4488
4489 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0)
4490 return log_error_errno(errno, "Failed to create kmsg socket pair: %m");
4491
4492 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, rtnl_socket_pair) < 0)
4493 return log_error_errno(errno, "Failed to create rtnl socket pair: %m");
4494
4495 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, pid_socket_pair) < 0)
4496 return log_error_errno(errno, "Failed to create pid socket pair: %m");
4497
4498 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uuid_socket_pair) < 0)
4499 return log_error_errno(errno, "Failed to create id socket pair: %m");
4500
4501 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, notify_socket_pair) < 0)
4502 return log_error_errno(errno, "Failed to create notify socket pair: %m");
4503
3acc84eb
FB		 4504 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, master_pty_socket_pair) < 0)
4505 return log_error_errno(errno, "Failed to create console socket pair: %m");
4506
b0067625
ZJS		 4507 if (arg_userns_mode != USER_NAMESPACE_NO)
4508 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uid_shift_socket_pair) < 0)
4509 return log_error_errno(errno, "Failed to create uid shift socket pair: %m");
4510
8199d554
LP		 4511 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN)
4512 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, unified_cgroup_hierarchy_socket_pair) < 0)
4513 return log_error_errno(errno, "Failed to create unified cgroup socket pair: %m");
4514
b0067625
ZJS		 4515 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
4516 * parent's blocking calls and give it a chance to call wait() and terminate. */
4517 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4518 if (r < 0)
4519 return log_error_errno(errno, "Failed to change the signal mask: %m");
4520
4521 r = sigaction(SIGCHLD, &sa, NULL);
4522 if (r < 0)
4523 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4524
d7bea6b6 4525 if (arg_network_namespace_path) {
5b4855ab
DDM		 4526 child_netns_fd = open(arg_network_namespace_path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
4527 if (child_netns_fd < 0)
d7bea6b6
DP		 4528 return log_error_errno(errno, "Cannot open file %s: %m", arg_network_namespace_path);
4529
5b4855ab 4530 r = fd_is_network_ns(child_netns_fd);
6619ad88
LP		 4531 if (r == -EUCLEAN)
4532 log_debug_errno(r, "Cannot determine if passed network namespace path '%s' really refers to a network namespace, assuming it does.", arg_network_namespace_path);
4533 else if (r < 0)
d7bea6b6 4534 return log_error_errno(r, "Failed to check %s fs type: %m", arg_network_namespace_path);
c6147113
LP		 4535 else if (r == 0)
4536 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
4537 "Path %s doesn't refer to a network namespace, refusing.", arg_network_namespace_path);
d7bea6b6
DP		 4538 }
4539
b0067625
ZJS		 4540 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
4541 if (*pid < 0)
4542 return log_error_errno(errno, "clone() failed%s: %m",
4543 errno == EINVAL ?
4544 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
4545
4546 if (*pid == 0) {
4547 /* The outer child only has a file system namespace. */
4548 barrier_set_role(&barrier, BARRIER_CHILD);
4549
b0067625
ZJS		 4550 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
4551 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
4552 pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
4553 uuid_socket_pair[0] = safe_close(uuid_socket_pair[0]);
4554 notify_socket_pair[0] = safe_close(notify_socket_pair[0]);
3acc84eb 4555 master_pty_socket_pair[0] = safe_close(master_pty_socket_pair[0]);
b0067625 4556 uid_shift_socket_pair[0] = safe_close(uid_shift_socket_pair[0]);
8199d554 4557 unified_cgroup_hierarchy_socket_pair[0] = safe_close(unified_cgroup_hierarchy_socket_pair[0]);
b0067625
ZJS		 4558
4559 (void) reset_all_signal_handlers();
4560 (void) reset_signal_mask();
4561
4562 r = outer_child(&barrier,
4563 arg_directory,
2d845785 4564 dissected_image,
b0067625
ZJS		 4565 secondary,
4566 pid_socket_pair[1],
4567 uuid_socket_pair[1],
4568 notify_socket_pair[1],
4569 kmsg_socket_pair[1],
4570 rtnl_socket_pair[1],
4571 uid_shift_socket_pair[1],
3acc84eb 4572 master_pty_socket_pair[1],
8199d554 4573 unified_cgroup_hierarchy_socket_pair[1],
d7bea6b6 4574 fds,
5b4855ab 4575 child_netns_fd);
b0067625
ZJS		 4576 if (r < 0)
4577 _exit(EXIT_FAILURE);
4578
4579 _exit(EXIT_SUCCESS);
4580 }
4581
4582 barrier_set_role(&barrier, BARRIER_PARENT);
4583
e4077ff6 4584 fdset_close(fds);
b0067625
ZJS		 4585
4586 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
4587 rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
4588 pid_socket_pair[1] = safe_close(pid_socket_pair[1]);
4589 uuid_socket_pair[1] = safe_close(uuid_socket_pair[1]);
4590 notify_socket_pair[1] = safe_close(notify_socket_pair[1]);
3acc84eb 4591 master_pty_socket_pair[1] = safe_close(master_pty_socket_pair[1]);
b0067625 4592 uid_shift_socket_pair[1] = safe_close(uid_shift_socket_pair[1]);
8199d554 4593 unified_cgroup_hierarchy_socket_pair[1] = safe_close(unified_cgroup_hierarchy_socket_pair[1]);
b0067625
ZJS		 4594
4595 if (arg_userns_mode != USER_NAMESPACE_NO) {
4596 /* The child just let us know the UID shift it might have read from the image. */
4597 l = recv(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
4598 if (l < 0)
4599 return log_error_errno(errno, "Failed to read UID shift: %m");
c6147113
LP		 4600 if (l != sizeof arg_uid_shift)
4601 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading UID shift.");
b0067625
ZJS		 4602
4603 if (arg_userns_mode == USER_NAMESPACE_PICK) {
4604 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
4605 * image, but if that's already in use, pick a new one, and report back to the child,
4606 * which one we now picked. */
4607
4608 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
4609 if (r < 0)
4610 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
4611
4612 l = send(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
4613 if (l < 0)
4614 return log_error_errno(errno, "Failed to send UID shift: %m");
c6147113
LP		 4615 if (l != sizeof arg_uid_shift)
4616 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
b0067625
ZJS		 4617 }
4618 }
4619
8199d554
LP		 4620 if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
4621 /* The child let us know the support cgroup mode it might have read from the image. */
4622 l = recv(unified_cgroup_hierarchy_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
4623 if (l < 0)
4624 return log_error_errno(errno, "Failed to read cgroup mode: %m");
c6147113
LP		 4625 if (l != sizeof(arg_unified_cgroup_hierarchy))
4626 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zu bytes).%s",
4627 l, l == 0 ? " The child is most likely dead." : "");
8199d554
LP		 4628 }
4629
b0067625 4630 /* Wait for the outer child. */
d2e0ac3d
LP		 4631 r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
4632 if (r < 0)
4633 return r;
4634 if (r != EXIT_SUCCESS)
4635 return -EIO;
b0067625
ZJS		 4636
4637 /* And now retrieve the PID of the inner child. */
4638 l = recv(pid_socket_pair[0], pid, sizeof *pid, 0);
4639 if (l < 0)
4640 return log_error_errno(errno, "Failed to read inner child PID: %m");
c6147113
LP		 4641 if (l != sizeof *pid)
4642 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading inner child PID.");
b0067625
ZJS		 4643
4644 /* We also retrieve container UUID in case it was generated by outer child */
4645 l = recv(uuid_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
4646 if (l < 0)
4647 return log_error_errno(errno, "Failed to read container machine ID: %m");
c6147113
LP		 4648 if (l != sizeof(arg_uuid))
4649 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading container machined ID.");
b0067625
ZJS		 4650
4651 /* We also retrieve the socket used for notifications generated by outer child */
4652 notify_socket = receive_one_fd(notify_socket_pair[0], 0);
4653 if (notify_socket < 0)
4654 return log_error_errno(notify_socket,
4655 "Failed to receive notification socket from the outer child: %m");
4656
4657 log_debug("Init process invoked as PID "PID_FMT, *pid);
4658
4659 if (arg_userns_mode != USER_NAMESPACE_NO) {
c6147113
LP		 4660 if (!barrier_place_and_sync(&barrier)) /* #1 */
4661 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625
ZJS		 4662
4663 r = setup_uid_map(*pid);
4664 if (r < 0)
4665 return r;
4666
4667 (void) barrier_place(&barrier); /* #2 */
4668 }
4669
4670 if (arg_private_network) {
75116558
PS		 4671 if (!arg_network_namespace_path) {
4672 /* Wait until the child has unshared its network namespace. */
c6147113
LP		 4673 if (!barrier_place_and_sync(&barrier)) /* #3 */
4674 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early");
75116558
PS		 4675 }
4676
5b4855ab
DDM		 4677 if (child_netns_fd < 0) {
4678 /* Make sure we have an open file descriptor to the child's network
4679 * namespace so it stays alive even if the child exits. */
4680 r = namespace_open(*pid, NULL, NULL, &child_netns_fd, NULL, NULL);
4681 if (r < 0)
4682 return log_error_errno(r, "Failed to open child network namespace: %m");
4683 }
4684
4685 r = move_network_interfaces(child_netns_fd, arg_network_interfaces);
b0067625
ZJS		 4686 if (r < 0)
4687 return r;
4688
4689 if (arg_network_veth) {
4690 r = setup_veth(arg_machine, *pid, veth_name,
4691 arg_network_bridge || arg_network_zone);
4692 if (r < 0)
4693 return r;
4694 else if (r > 0)
4695 ifi = r;
4696
4697 if (arg_network_bridge) {
4698 /* Add the interface to a bridge */
4699 r = setup_bridge(veth_name, arg_network_bridge, false);
4700 if (r < 0)
4701 return r;
4702 if (r > 0)
4703 ifi = r;
4704 } else if (arg_network_zone) {
4705 /* Add the interface to a bridge, possibly creating it */
4706 r = setup_bridge(veth_name, arg_network_zone, true);
4707 if (r < 0)
4708 return r;
4709 if (r > 0)
4710 ifi = r;
4711 }
4712 }
4713
4714 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
4715 if (r < 0)
4716 return r;
4717
4718 /* We created the primary and extra veth links now; let's remember this, so that we know to
4719 remove them later on. Note that we don't bother with removing veth links that were created
4720 here when their setup failed half-way, because in that case the kernel should be able to
4721 remove them on its own, since they cannot be referenced by anything yet. */
4722 *veth_created = true;
4723
4724 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
4725 if (r < 0)
4726 return r;
4727
4728 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
4729 if (r < 0)
4730 return r;
4731 }
4732
abdb9b08
LP		 4733 if (arg_register || !arg_keep_unit) {
4734 r = sd_bus_default_system(&bus);
4735 if (r < 0)
4736 return log_error_errno(r, "Failed to open system bus: %m");
e5a2d8b5
LP		 4737
4738 r = sd_bus_set_close_on_exit(bus, false);
4739 if (r < 0)
4740 return log_error_errno(r, "Failed to disable close-on-exit behaviour: %m");
abdb9b08
LP		 4741 }
4742
4743 if (!arg_keep_unit) {
4744 /* When a new scope is created for this container, then we'll be registered as its controller, in which
4745 * case PID 1 will send us a friendly RequestStop signal, when it is asked to terminate the
4746 * scope. Let's hook into that, and cleanly shut down the container, and print a friendly message. */
4747
75152a4d
LP		 4748 r = sd_bus_match_signal_async(
4749 bus,
4750 NULL,
4751 "org.freedesktop.systemd1",
4752 NULL,
4753 "org.freedesktop.systemd1.Scope",
4754 "RequestStop",
4755 on_request_stop, NULL, PID_TO_PTR(*pid));
abdb9b08 4756 if (r < 0)
75152a4d 4757 return log_error_errno(r, "Failed to request RequestStop match: %m");
abdb9b08
LP		 4758 }
4759
b0067625
ZJS		 4760 if (arg_register) {
4761 r = register_machine(
abdb9b08 4762 bus,
b0067625
ZJS		 4763 arg_machine,
4764 *pid,
4765 arg_directory,
4766 arg_uuid,
4767 ifi,
4768 arg_slice,
4769 arg_custom_mounts, arg_n_custom_mounts,
4770 arg_kill_signal,
4771 arg_property,
de40a303 4772 arg_property_message,
b0067625
ZJS		 4773 arg_keep_unit,
4774 arg_container_service_name);
4775 if (r < 0)
4776 return r;
abdb9b08 4777
cd2dfc6f
LP		 4778 } else if (!arg_keep_unit) {
4779 r = allocate_scope(
abdb9b08 4780 bus,
cd2dfc6f
LP		 4781 arg_machine,
4782 *pid,
4783 arg_slice,
4784 arg_custom_mounts, arg_n_custom_mounts,
4785 arg_kill_signal,
de40a303
LP		 4786 arg_property,
4787 arg_property_message);
cd2dfc6f
LP		 4788 if (r < 0)
4789 return r;
4790
4791 } else if (arg_slice || arg_property)
4792 log_notice("Machine and scope registration turned off, --slice= and --property= settings will have no effect.");
b0067625 4793
27da7ef0 4794 r = create_subcgroup(*pid, arg_keep_unit, arg_unified_cgroup_hierarchy);
b0067625
ZJS		 4795 if (r < 0)
4796 return r;
4797
27da7ef0 4798 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
720f0a2f
LP		 4799 if (r < 0)
4800 return r;
b0067625 4801
de54e02d 4802 r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
b0067625
ZJS		 4803 if (r < 0)
4804 return r;
4805
4806 /* Notify the child that the parent is ready with all
4807 * its setup (including cgroup-ification), and that
4808 * the child can now hand over control to the code to
4809 * run inside the container. */
75116558 4810 (void) barrier_place(&barrier); /* #4 */
b0067625
ZJS		 4811
4812 /* Block SIGCHLD here, before notifying child.
4813 * process_pty() will handle it with the other signals. */
4814 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
4815
4816 /* Reset signal to default */
4817 r = default_signals(SIGCHLD, -1);
4818 if (r < 0)
4819 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
4820
4821 r = sd_event_new(&event);
4822 if (r < 0)
4823 return log_error_errno(r, "Failed to get default event source: %m");
4824
8fd010bb
LP		 4825 (void) sd_event_set_watchdog(event, true);
4826
abdb9b08
LP		 4827 if (bus) {
4828 r = sd_bus_attach_event(bus, event, 0);
4829 if (r < 0)
4830 return log_error_errno(r, "Failed to attach bus to event loop: %m");
4831 }
4832
e96ceaba 4833 r = setup_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
b0067625
ZJS		 4834 if (r < 0)
4835 return r;
4836
4837 /* Let the child know that we are ready and wait that the child is completely ready now. */
c6147113
LP		 4838 if (!barrier_place_and_sync(&barrier)) /* #5 */
4839 return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
b0067625 4840
38ccb557 4841 /* At this point we have made use of the UID we picked, and thus nss-systemd/systemd-machined.service
b0067625
ZJS		 4842 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
4843 etc_passwd_lock = safe_close(etc_passwd_lock);
4844
04f590a4
LP		 4845 (void) sd_notifyf(false,
4846 "STATUS=Container running.\n"
4847 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
b0067625 4848 if (!arg_notify_ready)
919f5ae0 4849 (void) sd_notify(false, "READY=1\n");
b0067625
ZJS		 4850
4851 if (arg_kill_signal > 0) {
4852 /* Try to kill the init system on SIGINT or SIGTERM */
919f5ae0
LP		 4853 (void) sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
4854 (void) sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
b0067625
ZJS		 4855 } else {
4856 /* Immediately exit */
919f5ae0
LP		 4857 (void) sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
4858 (void) sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
b0067625
ZJS		 4859 }
4860
6916b164 4861 /* Exit when the child exits */
919f5ae0 4862 (void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
b0067625
ZJS		 4863
4864 if (arg_expose_ports) {
4865 r = expose_port_watch_rtnl(event, rtnl_socket_pair[0], on_address_change, exposed, &rtnl);
4866 if (r < 0)
4867 return r;
4868
4869 (void) expose_port_execute(rtnl, arg_expose_ports, exposed);
4870 }
4871
4872 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
4873
3acc84eb
FB		 4874 if (arg_console_mode != CONSOLE_PIPE) {
4875 _cleanup_close_ int fd = -1;
4876 PTYForwardFlags flags = 0;
de40a303 4877
3acc84eb
FB		 4878 /* Retrieve the master pty allocated by inner child */
4879 fd = receive_one_fd(master_pty_socket_pair[0], 0);
4880 if (fd < 0)
4881 return log_error_errno(fd, "Failed to receive master pty from the inner child: %m");
4882
4883 switch (arg_console_mode) {
de40a303 4884
3acc84eb
FB		 4885 case CONSOLE_READ_ONLY:
4886 flags |= PTY_FORWARD_READ_ONLY;
4887
4888 _fallthrough_;
4889
4890 case CONSOLE_INTERACTIVE:
4891 flags |= PTY_FORWARD_IGNORE_VHANGUP;
4892
4893 r = pty_forward_new(event, fd, flags, &forward);
4894 if (r < 0)
4895 return log_error_errno(r, "Failed to create PTY forwarder: %m");
4896
4897 if (arg_console_width != (unsigned) -1 || arg_console_height != (unsigned) -1)
4898 (void) pty_forward_set_width_height(forward,
4899 arg_console_width,
4900 arg_console_height);
4901 break;
4902
4903 default:
4904 assert(arg_console_mode == CONSOLE_PASSIVE);
4905 }
4906
4907 *master = TAKE_FD(fd);
de40a303 4908 }
b0067625
ZJS		 4909
4910 r = sd_event_loop(event);
4911 if (r < 0)
4912 return log_error_errno(r, "Failed to run event loop: %m");
4913
de40a303
LP		 4914 if (forward) {
4915 char last_char = 0;
b0067625 4916
de40a303
LP		 4917 (void) pty_forward_get_last_char(forward, &last_char);
4918 forward = pty_forward_free(forward);
b0067625 4919
de40a303
LP		 4920 if (!arg_quiet && last_char != '\n')
4921 putc('\n', stdout);
4922 }
b0067625
ZJS		 4923
4924 /* Kill if it is not dead yet anyway */
0bb0a9fa
ZJS		 4925 if (!arg_register && !arg_keep_unit && bus)
4926 terminate_scope(bus, arg_machine);
b0067625
ZJS		 4927
4928 /* Normally redundant, but better safe than sorry */
c67b0082 4929 (void) kill(*pid, SIGKILL);
b0067625 4930
5b4855ab
DDM		 4931 if (arg_private_network) {
4932 /* Move network interfaces back to the parent network namespace. We use `safe_fork`
4933 * to avoid having to move the parent to the child network namespace. */
4934 r = safe_fork(NULL, FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG, NULL);
4935 if (r < 0)
4936 return r;
4937
4938 if (r == 0) {
4939 _cleanup_close_ int parent_netns_fd = -1;
4940
4941 r = namespace_open(getpid(), NULL, NULL, &parent_netns_fd, NULL, NULL);
4942 if (r < 0) {
4943 log_error_errno(r, "Failed to open parent network namespace: %m");
4944 _exit(EXIT_FAILURE);
4945 }
4946
4947 r = namespace_enter(-1, -1, child_netns_fd, -1, -1);
4948 if (r < 0) {
4949 log_error_errno(r, "Failed to enter child network namespace: %m");
4950 _exit(EXIT_FAILURE);
4951 }
4952
4953 r = move_network_interfaces(parent_netns_fd, arg_network_interfaces);
4954 if (r < 0)
4955 log_error_errno(r, "Failed to move network interfaces back to parent network namespace: %m");
4956
4957 _exit(r < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
4958 }
4959 }
4960
b0067625
ZJS		 4961 r = wait_for_container(*pid, &container_status);
4962 *pid = 0;
4963
0bb0a9fa
ZJS		 4964 /* Tell machined that we are gone. */
4965 if (bus)
4966 (void) unregister_machine(bus, arg_machine);
4967
b0067625
ZJS		 4968 if (r < 0)
4969 /* We failed to wait for the container, or the container exited abnormally. */
4970 return r;
4971 if (r > 0 || container_status == CONTAINER_TERMINATED) {
27e29a1e
ZJS		 4972 /* r > 0 → The container exited with a non-zero status.
4973 * As a special case, we need to replace 133 with a different value,
4974 * because 133 is special-cased in the service file to reboot the container.
4975 * otherwise → The container exited with zero status and a reboot was not requested.
4976 */
2a49b612 4977 if (r == EXIT_FORCE_RESTART)
27e29a1e 4978 r = EXIT_FAILURE; /* replace 133 with the general failure code */
b0067625 4979 *ret = r;
b0067625
ZJS		 4980 return 0; /* finito */
4981 }
4982
4983 /* CONTAINER_REBOOTED, loop again */
4984
4985 if (arg_keep_unit) {
4986 /* Special handling if we are running as a service: instead of simply
4987 * restarting the machine we want to restart the entire service, so let's
4988 * inform systemd about this with the special exit code 133. The service
4989 * file uses RestartForceExitStatus=133 so that this results in a full
4990 * nspawn restart. This is necessary since we might have cgroup parameters
4991 * set we want to have flushed out. */
2a49b612
ZJS		 4992 *ret = EXIT_FORCE_RESTART;
4993 return 0; /* finito */
b0067625
ZJS		 4994 }
4995
4996 expose_port_flush(arg_expose_ports, exposed);
4997
4998 (void) remove_veth_links(veth_name, arg_network_veth_extra);
4999 *veth_created = false;
5000 return 1; /* loop again */
5001}
5002
bf428efb 5003static int initialize_rlimits(void) {
bf428efb
LP		 5004 /* The default resource limits the kernel passes to PID 1, as per kernel 4.16. Let's pass our container payload
5005 * the same values as the kernel originally passed to PID 1, in order to minimize differences between host and
5006 * container execution environments. */
5007
5008 static const struct rlimit kernel_defaults[_RLIMIT_MAX] = {
5009 [RLIMIT_AS] = { RLIM_INFINITY, RLIM_INFINITY },
5010 [RLIMIT_CORE] = { 0, RLIM_INFINITY },
5011 [RLIMIT_CPU] = { RLIM_INFINITY, RLIM_INFINITY },
5012 [RLIMIT_DATA] = { RLIM_INFINITY, RLIM_INFINITY },
5013 [RLIMIT_FSIZE] = { RLIM_INFINITY, RLIM_INFINITY },
5014 [RLIMIT_LOCKS] = { RLIM_INFINITY, RLIM_INFINITY },
5015 [RLIMIT_MEMLOCK] = { 65536, 65536 },
5016 [RLIMIT_MSGQUEUE] = { 819200, 819200 },
5017 [RLIMIT_NICE] = { 0, 0 },
5018 [RLIMIT_NOFILE] = { 1024, 4096 },
5019 [RLIMIT_RSS] = { RLIM_INFINITY, RLIM_INFINITY },
5020 [RLIMIT_RTPRIO] = { 0, 0 },
5021 [RLIMIT_RTTIME] = { RLIM_INFINITY, RLIM_INFINITY },
5022 [RLIMIT_STACK] = { 8388608, RLIM_INFINITY },
5023
5024 /* The kernel scales the default for RLIMIT_NPROC and RLIMIT_SIGPENDING based on the system's amount of
5025 * RAM. To provide best compatibility we'll read these limits off PID 1 instead of hardcoding them
5026 * here. This is safe as we know that PID 1 doesn't change these two limits and thus the original
5027 * kernel's initialization should still be valid during runtime — at least if PID 1 is systemd. Note
5028 * that PID 1 changes a number of other resource limits during early initialization which is why we
5029 * don't read the other limits from PID 1 but prefer the static table above. */
5030 };
5031
5032 int rl;
5033
5034 for (rl = 0; rl < _RLIMIT_MAX; rl++) {
bf428efb
LP		 5035 /* Let's only fill in what the user hasn't explicitly configured anyway */
5036 if ((arg_settings_mask & (SETTING_RLIMIT_FIRST << rl)) == 0) {
5037 const struct rlimit *v;
5038 struct rlimit buffer;
5039
5040 if (IN_SET(rl, RLIMIT_NPROC, RLIMIT_SIGPENDING)) {
5041 /* For these two let's read the limits off PID 1. See above for an explanation. */
5042
5043 if (prlimit(1, rl, NULL, &buffer) < 0)
5044 return log_error_errno(errno, "Failed to read resource limit RLIMIT_%s of PID 1: %m", rlimit_to_string(rl));
5045
5046 v = &buffer;
5047 } else
5048 v = kernel_defaults + rl;
5049
5050 arg_rlimit[rl] = newdup(struct rlimit, v, 1);
5051 if (!arg_rlimit[rl])
5052 return log_oom();
5053 }
5054
5055 if (DEBUG_LOGGING) {
5056 _cleanup_free_ char *k = NULL;
5057
5058 (void) rlimit_format(arg_rlimit[rl], &k);
5059 log_debug("Setting RLIMIT_%s to %s.", rlimit_to_string(rl), k);
5060 }
5061 }
5062
5063 return 0;
5064}
5065
287b7376
LP		 5066static int cant_be_in_netns(void) {
5067 union sockaddr_union sa = {
5068 .un = {
5069 .sun_family = AF_UNIX,
5070 .sun_path = "/run/udev/control",
5071 },
5072 };
5073 char udev_path[STRLEN("/proc//ns/net") + DECIMAL_STR_MAX(pid_t)];
5074 _cleanup_free_ char *udev_ns = NULL, *our_ns = NULL;
5075 _cleanup_close_ int fd = -1;
5076 struct ucred ucred;
5077 int r;
5078
5079 /* Check if we are in the same netns as udev. If we aren't, then device monitoring (and thus waiting
5080 * for loopback block devices) won't work, and we will hang. Detect this case and exit early with a
5081 * nice message. */
5082
5083 if (!arg_image) /* only matters if --image= us used, i.e. we actually need to use loopback devices */
5084 return 0;
5085
5086 fd = socket(AF_UNIX, SOCK_SEQPACKET|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
5087 if (fd < 0)
5088 return log_error_errno(errno, "Failed to allocate udev control socket: %m");
5089
5090 if (connect(fd, &sa.un, SOCKADDR_UN_LEN(sa.un)) < 0) {
5091
5092 if (errno == ENOENT || ERRNO_IS_DISCONNECT(errno))
5093 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5094 "Sorry, but --image= requires access to the host's /run/ hierarchy, since we need access to udev.");
5095
5096 return log_error_errno(errno, "Failed to connect socket to udev control socket: %m");
5097 }
5098
5099 r = getpeercred(fd, &ucred);
5100 if (r < 0)
5101 return log_error_errno(r, "Failed to determine peer of udev control socket: %m");
5102
5103 xsprintf(udev_path, "/proc/" PID_FMT "/ns/net", ucred.pid);
5104 r = readlink_malloc(udev_path, &udev_ns);
5105 if (r < 0)
5106 return log_error_errno(r, "Failed to read network namespace of udev: %m");
5107
5108 r = readlink_malloc("/proc/self/ns/net", &our_ns);
5109 if (r < 0)
5110 return log_error_errno(r, "Failed to read our own network namespace: %m");
5111
5112 if (!streq(our_ns, udev_ns))
5113 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
5114 "Sorry, but --image= is only supported in the main network namespace, since we need access to udev/AF_NETLINK.");
5115 return 0;
5116}
5117
44dbef90 5118static int run(int argc, char *argv[]) {
7bf011e3
LP		 5119 bool secondary = false, remove_directory = false, remove_image = false,
5120 veth_created = false, remove_tmprootdir = false;
2d845785 5121 _cleanup_close_ int master = -1;
03cfe0d5 5122 _cleanup_fdset_free_ FDSet *fds = NULL;
2d845785 5123 int r, n_fd_passed, ret = EXIT_SUCCESS;
5aa3eba5 5124 char veth_name[IFNAMSIZ] = "";
03cfe0d5 5125 union in_addr_union exposed = {};
8e766630 5126 _cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
c67b0082 5127 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
2d845785 5128 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
18b5886e
LP		 5129 _cleanup_(decrypted_image_unrefp) DecryptedImage *decrypted_image = NULL;
5130 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
7bf011e3 5131 pid_t pid = 0;
03cfe0d5
LP		 5132
5133 log_parse_environment();
5134 log_open();
415fc41c 5135
03cfe0d5
LP		 5136 r = parse_argv(argc, argv);
5137 if (r <= 0)
5138 goto finish;
5139
38ee19c0
ZJS		 5140 if (geteuid() != 0) {
5141 r = log_warning_errno(SYNTHETIC_ERRNO(EPERM),
5142 argc >= 2 ? "Need to be root." :
5143 "Need to be root (and some arguments are usually required).\nHint: try --help");
03cfe0d5 5144 goto finish;
38ee19c0 5145 }
fba868fa 5146
287b7376
LP		 5147 r = cant_be_in_netns();
5148 if (r < 0)
5149 goto finish;
5150
bf428efb
LP		 5151 r = initialize_rlimits();
5152 if (r < 0)
5153 goto finish;
5154
de40a303
LP		 5155 r = load_oci_bundle();
5156 if (r < 0)
5157 goto finish;
5158
f757855e
LP		 5159 r = determine_names();
5160 if (r < 0)
5161 goto finish;
5162
5163 r = load_settings();
5164 if (r < 0)
5165 goto finish;
5166
d4d99bc6 5167 r = cg_unified();
5eee8290
LP		 5168 if (r < 0) {
5169 log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
5170 goto finish;
5171 }
5172
f757855e
LP		 5173 r = verify_arguments();
5174 if (r < 0)
5175 goto finish;
03cfe0d5 5176
49048684
ZJS		 5177 /* Reapply environment settings. */
5178 (void) detect_unified_cgroup_hierarchy_from_environment();
8199d554 5179
2949ff26
LP		 5180 /* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
5181 * the result is closed. Note that the container payload child will reset signal mask+handler anyway,
5182 * so just turning this off here means we only turn it off in nspawn itself, not any children. */
5183 (void) ignore_signals(SIGPIPE, -1);
5184
03cfe0d5
LP		 5185 n_fd_passed = sd_listen_fds(false);
5186 if (n_fd_passed > 0) {
5187 r = fdset_new_listen_fds(&fds, false);
5188 if (r < 0) {
5189 log_error_errno(r, "Failed to collect file descriptors: %m");
5190 goto finish;
5191 }
5192 }
5193
83e803a9
ZJS		 5194 /* The "default" umask. This is appropriate for most file and directory
5195 * operations performed by nspawn, and is the umask that will be used for
5196 * the child. Functions like copy_devnodes() change the umask temporarily. */
5197 umask(0022);
5198
03cfe0d5
LP		 5199 if (arg_directory) {
5200 assert(!arg_image);
5201
b35ca61a
LP		 5202 /* Safety precaution: let's not allow running images from the live host OS image, as long as
5203 * /var from the host will propagate into container dynamically (because bad things happen if
5204 * two systems write to the same /var). Let's allow it for the special cases where /var is
5205 * either copied (i.e. --ephemeral) or replaced (i.e. --volatile=yes|state). */
5206 if (path_equal(arg_directory, "/") && !(arg_ephemeral || IN_SET(arg_volatile_mode, VOLATILE_YES, VOLATILE_STATE))) {
5207 log_error("Spawning container on root directory is not supported. Consider using --ephemeral, --volatile=yes or --volatile=state.");
03cfe0d5
LP		 5208 r = -EINVAL;
5209 goto finish;
5210 }
5211
5212 if (arg_ephemeral) {
5213 _cleanup_free_ char *np = NULL;
5214
8d4aa2bb 5215 r = chase_symlinks_and_update(&arg_directory, 0);
3f342ec4
LP		 5216 if (r < 0)
5217 goto finish;
5218
7bf011e3
LP		 5219 /* If the specified path is a mount point we generate the new snapshot immediately
5220 * inside it under a random name. However if the specified is not a mount point we
5221 * create the new snapshot in the parent directory, just next to it. */
e1873695 5222 r = path_is_mount_point(arg_directory, NULL, 0);
03cfe0d5
LP		 5223 if (r < 0) {
5224 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
5225 goto finish;
5226 }
5227 if (r > 0)
770b5ce4 5228 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 5229 else
770b5ce4 5230 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5 5231 if (r < 0) {
0f3be6ca 5232 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
03cfe0d5
LP		 5233 goto finish;
5234 }
5235
6992459c 5236 /* We take an exclusive lock on this image, since it's our private, ephemeral copy
162392b7 5237 * only owned by us and no one else. */
6992459c 5238 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
03cfe0d5
LP		 5239 if (r < 0) {
5240 log_error_errno(r, "Failed to lock %s: %m", np);
5241 goto finish;
5242 }
5243
7bf011e3
LP		 5244 {
5245 BLOCK_SIGNALS(SIGINT);
5246 r = btrfs_subvol_snapshot(arg_directory, np,
5247 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5248 BTRFS_SNAPSHOT_FALLBACK_COPY |
5249 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5250 BTRFS_SNAPSHOT_RECURSIVE |
5251 BTRFS_SNAPSHOT_QUOTA |
5252 BTRFS_SNAPSHOT_SIGINT);
5253 }
5254 if (r == -EINTR) {
5255 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", np);
5256 goto finish;
5257 }
03cfe0d5
LP		 5258 if (r < 0) {
5259 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
5260 goto finish;
ec16945e
LP		 5261 }
5262
1cc6c93a 5263 free_and_replace(arg_directory, np);
17cbb288 5264 remove_directory = true;
30535c16 5265 } else {
cb638b5e 5266 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
8d4aa2bb
LP		 5267 if (r < 0)
5268 goto finish;
5269
30535c16
LP		 5270 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5271 if (r == -EBUSY) {
5272 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
5273 goto finish;
5274 }
5275 if (r < 0) {
5276 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
476b8254 5277 goto finish;
30535c16
LP		 5278 }
5279
5280 if (arg_template) {
8d4aa2bb 5281 r = chase_symlinks_and_update(&arg_template, 0);
3f342ec4
LP		 5282 if (r < 0)
5283 goto finish;
5284
7bf011e3
LP		 5285 {
5286 BLOCK_SIGNALS(SIGINT);
5287 r = btrfs_subvol_snapshot(arg_template, arg_directory,
5288 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
5289 BTRFS_SNAPSHOT_FALLBACK_COPY |
5290 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
5291 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
5292 BTRFS_SNAPSHOT_RECURSIVE |
5293 BTRFS_SNAPSHOT_QUOTA |
5294 BTRFS_SNAPSHOT_SIGINT);
5295 }
ff6c6cc1
LP		 5296 if (r == -EEXIST)
5297 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5298 "Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
7bf011e3
LP		 5299 else if (r == -EINTR) {
5300 log_error_errno(r, "Interrupted while copying file system tree to %s, removed again.", arg_directory);
5301 goto finish;
5302 } else if (r < 0) {
83521414 5303 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16 5304 goto finish;
ff6c6cc1
LP		 5305 } else
5306 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO,
5307 "Populated %s from template %s.", arg_directory, arg_template);
30535c16 5308 }
ec16945e
LP		 5309 }
5310
7732f92b 5311 if (arg_start_mode == START_BOOT) {
a5201ed6 5312 const char *p;
c9fe05e0 5313
a5201ed6
LP		 5314 if (arg_pivot_root_new)
5315 p = prefix_roota(arg_directory, arg_pivot_root_new);
5316 else
5317 p = arg_directory;
c9fe05e0
AR		 5318
5319 if (path_is_os_tree(p) <= 0) {
5320 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", p);
ec16945e 5321 r = -EINVAL;
1b9e5b12
LP		 5322 goto finish;
5323 }
5324 } else {
c9fe05e0
AR		 5325 const char *p, *q;
5326
a5201ed6
LP		 5327 if (arg_pivot_root_new)
5328 p = prefix_roota(arg_directory, arg_pivot_root_new);
5329 else
5330 p = arg_directory;
c9fe05e0
AR		 5331
5332 q = strjoina(p, "/usr/");
1b9e5b12 5333
c9fe05e0
AR		 5334 if (laccess(q, F_OK) < 0) {
5335 log_error("Directory %s doesn't look like it has an OS tree. Refusing.", p);
ec16945e 5336 r = -EINVAL;
1b9e5b12 5337 goto finish;
1b9e5b12
LP		 5338 }
5339 }
ec16945e 5340
6b9132a9 5341 } else {
e7cbe5cb 5342 DissectImageFlags dissect_image_flags = DISSECT_IMAGE_REQUIRE_ROOT | DISSECT_IMAGE_RELAX_VAR_CHECK;
ec16945e
LP		 5343 assert(arg_image);
5344 assert(!arg_template);
5345
8d4aa2bb 5346 r = chase_symlinks_and_update(&arg_image, 0);
3f342ec4
LP		 5347 if (r < 0)
5348 goto finish;
5349
0f3be6ca
LP		 5350 if (arg_ephemeral) {
5351 _cleanup_free_ char *np = NULL;
5352
5353 r = tempfn_random(arg_image, "machine.", &np);
5354 if (r < 0) {
5355 log_error_errno(r, "Failed to generate name for image snapshot: %m");
5356 goto finish;
5357 }
5358
6992459c
LP		 5359 /* Always take an exclusive lock on our own ephemeral copy. */
5360 r = image_path_lock(np, LOCK_EX|LOCK_NB, &tree_global_lock, &tree_local_lock);
0f3be6ca
LP		 5361 if (r < 0) {
5362 r = log_error_errno(r, "Failed to create image lock: %m");
5363 goto finish;
5364 }
5365
7bf011e3
LP		 5366 {
5367 BLOCK_SIGNALS(SIGINT);
5368 r = copy_file(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600, FS_NOCOW_FL, FS_NOCOW_FL, COPY_REFLINK|COPY_CRTIME|COPY_SIGINT);
5369 }
5370 if (r == -EINTR) {
5371 log_error_errno(r, "Interrupted while copying image file to %s, removed again.", np);
5372 goto finish;
5373 }
0f3be6ca
LP		 5374 if (r < 0) {
5375 r = log_error_errno(r, "Failed to copy image file: %m");
5376 goto finish;
5377 }
5378
1cc6c93a 5379 free_and_replace(arg_image, np);
0f3be6ca
LP		 5380 remove_image = true;
5381 } else {
5382 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
5383 if (r == -EBUSY) {
5384 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
5385 goto finish;
5386 }
5387 if (r < 0) {
5388 r = log_error_errno(r, "Failed to create image lock: %m");
5389 goto finish;
5390 }
4623e8e6 5391
89e62e0b
LP		 5392 r = verity_settings_load(
5393 &arg_verity_settings,
5394 arg_image, NULL, NULL);
e7cbe5cb
LB		 5395 if (r < 0) {
5396 log_error_errno(r, "Failed to read verity artefacts for %s: %m", arg_image);
5397 goto finish;
78ebe980 5398 }
89e62e0b
LP		 5399
5400 if (arg_verity_settings.data_path)
5401 dissect_image_flags |= DISSECT_IMAGE_NO_PARTITION_TABLE;
30535c16
LP		 5402 }
5403
c67b0082 5404 if (!mkdtemp(tmprootdir)) {
0f3be6ca 5405 r = log_error_errno(errno, "Failed to create temporary directory: %m");
6b9132a9 5406 goto finish;
1b9e5b12 5407 }
6b9132a9 5408
c67b0082
LP		 5409 remove_tmprootdir = true;
5410
5411 arg_directory = strdup(tmprootdir);
1b9e5b12
LP		 5412 if (!arg_directory) {
5413 r = log_oom();
5414 goto finish;
6b9132a9 5415 }
88213476 5416
89e62e0b
LP		 5417 r = loop_device_make_by_path(
5418 arg_image,
5419 arg_read_only ? O_RDONLY : O_RDWR,
5420 FLAGS_SET(dissect_image_flags, DISSECT_IMAGE_NO_PARTITION_TABLE) ? 0 : LO_FLAGS_PARTSCAN,
5421 &loop);
2d845785
LP		 5422 if (r < 0) {
5423 log_error_errno(r, "Failed to set up loopback block device: %m");
842f3b0f
LP		 5424 goto finish;
5425 }
1b9e5b12 5426
4526113f 5427 r = dissect_image_and_warn(
e0f9e7bd 5428 loop->fd,
4526113f 5429 arg_image,
89e62e0b 5430 &arg_verity_settings,
18d73705 5431 NULL,
e7cbe5cb 5432 dissect_image_flags,
e0f9e7bd 5433 &dissected_image);
2d845785 5434 if (r == -ENOPKG) {
4526113f 5435 /* dissected_image_and_warn() already printed a brief error message. Extend on that with more details */
2d845785
LP		 5436 log_notice("Note that the disk image needs to\n"
5437 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
5438 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
19ac32cd 5439 " c) or follow https://systemd.io/DISCOVERABLE_PARTITIONS\n"
2d845785
LP		 5440 " d) or contain a file system without a partition table\n"
5441 "in order to be bootable with systemd-nspawn.");
1b9e5b12 5442 goto finish;
2d845785 5443 }
4526113f 5444 if (r < 0)
842f3b0f 5445 goto finish;
1b9e5b12 5446
89e62e0b 5447 if (!arg_verity_settings.root_hash && dissected_image->can_verity)
4623e8e6
LP		 5448 log_notice("Note: image %s contains verity information, but no root hash specified! Proceeding without integrity checking.", arg_image);
5449
89e62e0b
LP		 5450 r = dissected_image_decrypt_interactively(
5451 dissected_image,
5452 NULL,
5453 &arg_verity_settings,
5454 0,
5455 &decrypted_image);
1b9e5b12
LP		 5456 if (r < 0)
5457 goto finish;
0f3be6ca
LP		 5458
5459 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
5460 if (remove_image && unlink(arg_image) >= 0)
5461 remove_image = false;
842f3b0f 5462 }
842f3b0f 5463
86c0dd4a 5464 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5a8af538
LP		 5465 if (r < 0)
5466 goto finish;
5467
de40a303
LP		 5468 if (arg_console_mode < 0)
5469 arg_console_mode =
5470 isatty(STDIN_FILENO) > 0 &&
5471 isatty(STDOUT_FILENO) > 0 ? CONSOLE_INTERACTIVE : CONSOLE_READ_ONLY;
9c857b9d 5472
de40a303
LP		 5473 if (arg_console_mode == CONSOLE_PIPE) /* if we pass STDERR on to the container, don't add our own logs into it too */
5474 arg_quiet = true;
a258bf26 5475
9c857b9d
LP		 5476 if (!arg_quiet)
5477 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
5478 arg_machine, arg_image ?: arg_directory);
5479
72c0a2c2 5480 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
a258bf26 5481
66edd963 5482 if (prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0) < 0) {
03cfe0d5
LP		 5483 r = log_error_errno(errno, "Failed to become subreaper: %m");
5484 goto finish;
5485 }
5486
d87be9b0 5487 for (;;) {
3acc84eb 5488 r = run_container(dissected_image,
44dbef90
LP		 5489 secondary,
5490 fds,
5491 veth_name, &veth_created,
3acc84eb 5492 &exposed, &master,
44dbef90 5493 &pid, &ret);
b0067625 5494 if (r <= 0)
d87be9b0 5495 break;
d87be9b0 5496 }
88213476
LP		 5497
5498finish:
04f590a4
LP		 5499 (void) sd_notify(false,
5500 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
5501 "STOPPING=1\nSTATUS=Terminating...");
af4ec430 5502
9444b1f2 5503 if (pid > 0)
c67b0082 5504 (void) kill(pid, SIGKILL);
88213476 5505
503546da 5506 /* Try to flush whatever is still queued in the pty */
6a0f896b 5507 if (master >= 0) {
1c876927 5508 (void) copy_bytes(master, STDOUT_FILENO, (uint64_t) -1, 0);
6a0f896b
LP		 5509 master = safe_close(master);
5510 }
5511
5512 if (pid > 0)
5513 (void) wait_for_terminate(pid, NULL);
503546da 5514
50ebcf6c
LP		 5515 pager_close();
5516
17cbb288 5517 if (remove_directory && arg_directory) {
ec16945e
LP		 5518 int k;
5519
17cbb288 5520 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
ec16945e 5521 if (k < 0)
17cbb288 5522 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
ec16945e
LP		 5523 }
5524
0f3be6ca
LP		 5525 if (remove_image && arg_image) {
5526 if (unlink(arg_image) < 0)
5527 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
5528 }
5529
c67b0082
LP		 5530 if (remove_tmprootdir) {
5531 if (rmdir(tmprootdir) < 0)
5532 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
5533 }
5534
785890ac
LP		 5535 if (arg_machine) {
5536 const char *p;
5537
63c372cb 5538 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 5539 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 5540 }
5541
7a8f6325 5542 expose_port_flush(arg_expose_ports, &exposed);
7513c5b8
LP		 5543
5544 if (veth_created)
5545 (void) remove_veth_links(veth_name, arg_network_veth_extra);
22b28dfd 5546 (void) remove_bridge(arg_network_zone);
f757855e 5547
f757855e
LP		 5548 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
5549 expose_port_free_all(arg_expose_ports);
bf428efb 5550 rlimit_free_all(arg_rlimit);
b2645747 5551 device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
3652872a 5552 credential_free_all(arg_credentials, arg_n_credentials);
6d0b55c2 5553
44dbef90
LP		 5554 if (r < 0)
5555 return r;
5556
5557 return ret;
88213476 5558}
44dbef90
LP		 5559
5560DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.