man2/pivot_root.2

   1 .\" Copyright (C) 2000 by Werner Almesberger
   2 .\" and Copyright (C) 2019 Michael Kerrisk <mtk.manpages@gmail.com>
   3 .\"
   4 .\" %%%LICENSE_START(GPL_NOVERSION_ONELINE)
   5 .\" May be distributed under GPL
   6 .\" %%%LICENSE_END
   7 .\"
   8 .\" Written 2000-02-23 by Werner Almesberger
   9 .\" Modified 2004-06-17 Michael Kerrisk <mtk.manpages@gmail.com>
  10 .\"
  11 .TH PIVOT_ROOT 2 2019-08-02 "Linux" "Linux Programmer's Manual"
  12 .SH NAME
  13 pivot_root \- change the root filesystem
  14 .SH SYNOPSIS
  15 .BI "int pivot_root(const char *" new_root ", const char *" put_old );
  16 .PP
  17 .IR Note :
  18 There is no glibc wrapper for this system call; see NOTES.
  19 .SH DESCRIPTION
  20 .BR pivot_root ()
  21 changes the root filesystem in the mount namespace of the calling process.
  22 More precisely, it moves the root filesystem to the
  23 directory \fIput_old\fP and makes \fInew_root\fP the new root filesystem.
  24 The calling process must have the
  25 .B CAP_SYS_ADMIN
  26 capability in the user namespace that owns the caller's mount namespace.
  27 .PP
  28 .BR pivot_root ()
  29 may or may not change the current root and the current
  30 working directory of any processes or threads that
  31 use the old root directory and which are in
  32 the same mount namespace as the caller of
  33 .BR pivot_root ().
  34 The caller of
  35 .BR pivot_root ()
  36 must ensure that processes with root or current working directory
  37 at the old root operate correctly in either case.
  38 An easy way to ensure this is to change their
  39 root and current working directory to \fInew_root\fP before invoking
  40 .BR pivot_root ().
  41 .PP
  42 The paragraph above is intentionally vague because the implementation of
  43 .BR pivot_root ()
  44 may change in the future
  45 (or so it was thought when this system call was first added).
  46 However,
  47 the behavior on this point has remained consistent since
  48 .BR pivot_root ()
  49 was first implemented:
  50 .BR pivot_root ()
  51 changes the root directory and the current working directory
  52 of each process or thread in the same mount namespace to
  53 .I new_root
  54 if they point to the old root directory.
  55 This is necessary in order to prevent kernel threads from keeping the old
  56 root directory busy with their root and current working directory,
  57 even if they never access
  58 the filesystem in any way.
  59 Perhaps one day there may be a mechanism for
  60 kernel threads to explicitly relinquish any access to the filesystem,
  61 such that this fairly intrusive mechanism can be removed from
  62 .BR pivot_root ().
  63 .PP
  64 Note that this also applies to the calling process:
  65 .BR pivot_root ()
  66 may or may not affect its current working directory.
  67 It is therefore recommended to call
  68 \fBchdir("/")\fP immediately after
  69 .BR pivot_root ().
  70 .PP
  71 The following restrictions apply to \fInew_root\fP and \fIput_old\fP:
  72 .IP \- 3
  73 They must be directories.
  74 .IP \-
  75 \fInew_root\fP and \fIput_old\fP must not be on the same filesystem as
  76 the current root.
  77 .IP \-
  78 \fIput_old\fP must be underneath \fInew_root\fP, that is, adding a nonzero
  79 number of \fI/..\fP to the string pointed to by \fIput_old\fP must yield
  80 the same directory as \fInew_root\fP.
  81 .IP \-
  82 .I new_root
  83 must be a mount point.
  84 (If it is not otherwise a mount point, it suffices to bind mount
  85 .I new_root
  86 on top of itself.)
  87 .IP \-
  88 The propagation type of
  89 .I new_root
  90 and its parent mount must not be
  91 .BR MS_SHARED ;
  92 similarly, if
  93 .I put_old
  94 is an existing mount point, its propagation type must not be
  95 .BR MS_SHARED .
  96 .PP
  97 See also
  98 .BR pivot_root (8)
  99 for additional usage examples.
 100 .PP
 101 If the current root is not a mount point (e.g., after an earlier
 102 .BR chroot (2)
 103 or
 104 .BR pivot_root ()),
 105 then the mount point of the filesystem containing the current root directory
 106 (i.e., not the directory itself) is mounted on \fIput_old\fP.
 107 .SH RETURN VALUE
 108 On success, zero is returned.
 109 On error, \-1 is returned, and
 110 \fIerrno\fP is set appropriately.
 111 .SH ERRORS
 112 .BR pivot_root ()
 113 may fail with any of the same errors as
 114 .BR stat (2).
 115 Additionally, it may fail with the following errors:
 116 .TP
 117 .B EBUSY
 118 \fInew_root\fP or \fIput_old\fP are on the current root filesystem.
 119 .TP
 120 .B EINVAL
 121 .I new_root
 122 is not a mount point.
 123 .TP
 124 .B EINVAL
 125 \fIput_old\fP is not underneath \fInew_root\fP.
 126 .TP
 127 .B EINVAL
 128 The current root is on the rootfs (initial ramfs) filesystem; see NOTES.
 129 .TP
 130 .B EINVAL
 131 Either the mount point at
 132 .IR new_root ,
 133 or the parent mount of that mount point,
 134 has propagation type
 135 .BR MS_SHARED .
 136 .TP
 137 .B EINVAL
 138 .I put_old
 139 is a mount point and has the propagation type
 140 .BR MS_SHARED .
 141 .TP
 142 .B ENOTDIR
 143 \fInew_root\fP or \fIput_old\fP is not a directory.
 144 .TP
 145 .B EPERM
 146 The calling process does not have the
 147 .B CAP_SYS_ADMIN
 148 capability.
 149 .SH VERSIONS
 150 .BR pivot_root ()
 151 was introduced in Linux 2.3.41.
 152 .SH CONFORMING TO
 153 .BR pivot_root ()
 154 is Linux-specific and hence is not portable.
 155 .SH NOTES
 156 Glibc does not provide a wrapper for this system call; call it using
 157 .BR syscall (2).
 158 .PP
 159 .BR pivot_root ()
 160 allows the caller to switch to a new root filesystem while at the same time
 161 placing the old root mount at a location under
 162 .I new_root
 163 from where it can subsequently be unmounted.
 164 (The fact that it moves all processes that have a root directory
 165 or current working directory on the old root filesystem to the
 166 new root filesystem frees the old root filesystem of users,
 167 allowing it to be unmounted more easily.)
 168 A typical use of
 169 .BR pivot_root ()
 170 is during system startup, when the
 171 system mounts a temporary root filesystem (e.g., an \fBinitrd\fP), then
 172 mounts the real root filesystem, and eventually turns the latter into
 173 the current root of all relevant processes or threads.
 174 A modern use is to set up a root filesystem during
 175 the creation of a container.
 176 .PP
 177 The rootfs (initial ramfs) cannot be
 178 .BR pivot_root ()ed.
 179 The recommended method of changing the root filesystem in this case is
 180 to delete everything in rootfs, overmount rootfs with the new root, attach
 181 .IR stdin / stdout / stderr
 182 to the new
 183 .IR /dev/console ,
 184 and exec the new
 185 .BR init (1).
 186 Helper programs for this process exist; see
 187 .BR switch_root (8).
 188 .SH BUGS
 189 .BR pivot_root ()
 190 should not have to change root and current working directory of other
 191 processes in the system.
 192 .PP
 193 Some of the more obscure uses of
 194 .BR pivot_root ()
 195 may quickly lead to
 196 insanity.
 197 .SH EXAMPLE
 198 .PP
 199 The program below demonstrates the use of
 200 .BR pivot_root ()
 201 inside a mount namespace that is created using
 202 .BR clone (2).
 203 After pivoting to the root directory named in the program's
 204 first command-line argument, the child created by
 205 .BR clone (2)
 206 then executes the program named in the remaining command-line arguments.
 207 .PP
 208 We demonstrate the program by creating a directory that will serve as
 209 the new root filesystem and placing a copy of the (statically linked)
 210 .BR busybox (1)
 211 executable in that directory.
 212 .PP
 213 .in +4n
 214 .EX
 215 $ \fBmkdir /tmp/rootfs\fP
 216 $ \fBls \-id /tmp/rootfs\fP    # Show inode number of new root directory
 217 319459 /tmp/rootfs
 218 $ \fBcp $(which busybox) /tmp/rootfs\fP
 219 $ \fBPS1='bbsh$ ' sudo ./pivot_root_demo /tmp/rootfs /busybox sh\fP
 220 bbsh$ \fBPATH=/\fP
 221 bbsh$ \fBbusybox ln busybox ln\fP
 222 bbsh$ \fBln busybox echo\fP
 223 bbsh$ \fBln busybox ls\fP
 224 bbsh$ \fBls\fP
 225 busybox  echo     ln       ls
 226 bbsh$ \fBls \-id /\fP          # Compare with inode number above
 227 319459 /
 228 bbsh$ \fBecho \(aqhello world\(aq\fP
 229 hello world
 230 .EE
 231 .in
 232 .SS Program source
 233 \&
 234 .PP
 235 .EX
 236 /* pivot_root_demo.c */
 237
 238 #define _GNU_SOURCE
 239 #include <sched.h>
 240 #include <stdio.h>
 241 #include <stdlib.h>
 242 #include <unistd.h>
 243 #include <sys/wait.h>
 244 #include <sys/syscall.h>
 245 #include <sys/mount.h>
 246 #include <sys/stat.h>
 247 #include <limits.h>
 248
 249 #define errExit(msg)    do { perror(msg); exit(EXIT_FAILURE); \e
 250                         } while (0)
 251
 252 static int
 253 pivot_root(const char *new_root, const char *put_old)
 254 {
 255     return syscall(SYS_pivot_root, new_root, put_old);
 256 }
 257
 258 #define STACK_SIZE (1024 * 1024)
 259
 260 static int              /* Startup function for cloned child */
 261 child(void *arg)
 262 {
 263     char **args = arg;
 264     char *new_root = args[0];
 265     const char *put_old = "/oldrootfs";
 266     char path[PATH_MAX];
 267
 268     /* Ensure that \(aqnew_root\(aq and its parent mount don\(aqt have
 269        shared propagation (which would cause pivot_root() to
 270        return an error), and prevent propagation of mount
 271        events to the initial mount namespace */
 272
 273     if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) == 1)
 274         errExit("mount\-MS_PRIVATE");
 275
 276     /* Ensure that \(aqnew_root\(aq is a mount point */
 277
 278     if (mount(new_root, new_root, NULL, MS_BIND, NULL) == \-1)
 279         errExit("mount\-MS_BIND");
 280
 281     /* Create directory to which old root will be pivoted */
 282
 283     snprintf(path, sizeof(path), "%s/%s", new_root, put_old);
 284     if (mkdir(path, 0777) == \-1)
 285         errExit("mkdir");
 286
 287     /* And pivot the root filesystem */
 288
 289     if (pivot_root(new_root, path) == \-1)
 290         errExit("pivot_root");
 291
 292     /* Switch the current working working directory to "/" */
 293
 294     if (chdir("/") == \-1)
 295         errExit("chdir");
 296
 297     /* Unmount old root and remove mount point */
 298
 299     if (umount2(put_old, MNT_DETACH) == \-1)
 300         perror("umount2");
 301     if (rmdir(put_old) == \-1)
 302         perror("rmdir");
 303
 304     /* Execute the command specified in argv[1]... */
 305
 306     execv(args[1], &args[1]);
 307     errExit("execv");
 308 }
 309
 310 int
 311 main(int argc, char *argv[])
 312 {
 313     /* Create a child process in a new mount namespace */
 314
 315     char *stack = malloc(STACK_SIZE);
 316     if (stack == NULL)
 317         errExit("malloc");
 318
 319     if (clone(child, stack + STACK_SIZE,
 320                 CLONE_NEWNS | SIGCHLD, &argv[1]) == \-1)
 321         errExit("clone");
 322
 323     /* Parent falls through to here; wait for child */
 324
 325     if (wait(NULL) == \-1)
 326         errExit("wait");
 327
 328     exit(EXIT_SUCCESS);
 329 }
 330 .EE
 331 .SH SEE ALSO
 332 .BR chdir (2),
 333 .BR chroot (2),
 334 .BR mount (2),
 335 .BR stat (2),
 336 .BR initrd (4),
 337 .BR mount_namespaces (7),
 338 .BR pivot_root (8),
 339 .BR switch_root (8)